bash 允许 ssh 传入/传出并阻止除特定端口之外的所有传出
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/19776681/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Allow ssh incoming/outgoing and blocking all outgoing besides specific ports
提问by randy newfield
I am trying to create iptable rules that will allow incoming and outgoing ssh connections, and then allow outbound connections to specific ports, then finally drop anything that doesnt match.
我正在尝试创建允许传入和传出 ssh 连接的 iptable 规则，然后允许到特定端口的出站连接，最后删除任何不匹配的内容。
These are the rules I have come up with, the SSH rules work, but when I tunnel into the box I cant seem to access http (port 80) even though i've allowed it. Can anyone spot the mistake?
这些是我提出的规则，SSH 规则有效，但是当我通过隧道进入盒子时，即使我允许它，我似乎也无法访问 http（端口 80）。任何人都可以发现错误吗？
#!/bin/bash
#clear iptables
iptables -F
iptables -X
#set default policy to drop
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#accept everything no matter port on localhost
iptables -A INPUT -i lo -j ACCEPT
#allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#allow input on port 22, (established connections auto accepted)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#allow traffic going to specific outbound ports
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 6667 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 6697 -j ACCEPT
#...
#drop anything that doesnt match the rules above
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
Thanks for your time.
谢谢你的时间。
回答by MeyerRJ
You might want to add the DNS ports, otherwise you may not be able to resolve any hostnames.
您可能想要添加 DNS 端口，否则您可能无法解析任何主机名。
Allowing OUTPUT for TCP and UDP Port 53 should help.
允许 OUTPUT 用于 TCP 和 UDP 端口 53 应该会有所帮助。
回答by Ignacio Gutiérrez Torrero
You need to open port 80 for input and output with a rule like this:
您需要使用如下规则为输入和输出打开端口 80：
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
