如果我忽略这一行
$IPT -I INPUT -i $WAN_NIC -j ACCEPT 从我的防火墙脚本下面，然后我不能SSH到服务器。
我理解的方式
$IPT -I INPUT -i $WAN_NIC -j ACCEPT
是它将允许$ WAN_NIC的所有stream量和作出
$IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT $IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT $IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT $IPT -A INPUT -j REJECT
过时了，这不是我想要的。
我的目标是在WAN_NIC上WAN_NIC允许SSH，WWW和ping。
题
规则应该如何，如果我只想在WAN_NIC上使用SSH，WWW和ping？
脚本
$IPT -F $IPT -X # Allow all outgoing $IPT -P OUTPUT ACCEPT # Filter rules $IPT -A INPUT -i lo -j ACCEPT $IPT -I INPUT -i $WAN_NIC -j ACCEPT $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT $IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT $IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT $IPT -A INPUT -j REJECT $IPT -t nat -P PREROUTING ACCEPT $IPT -t nat -P INPUT ACCEPT $IPT -t nat -P OUTPUT ACCEPT # Masquerade 192.168.245.8 - 192.168.245.255 $IPT -t nat -P POSTROUTING ACCEPT $IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE $IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE $IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE $IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE $IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE # Allow only IPs from LAN_NET to connect to LAN_NIC $IPT -A FORWARD -i $LAN_NIC ! -s $LAN_NET -j DROP $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT $IPT -A FORWARD -j REJECT
更新
当我无法SSH时，添加了我的nat规则和iptables的以下输出。
root@ts:~# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- 192.168.245.0/24 anywhere ACCEPT all -- linuxterm2.local anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:www REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain FORWARD (policy DROP) target prot opt source destination DROP all -- !192.168.245.0/24 anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- 192.168.245.128/25 anywhere state NEW ACCEPT all -- 192.168.245.64/26 anywhere state NEW ACCEPT all -- 192.168.245.32/27 anywhere state NEW ACCEPT all -- 192.168.245.16/28 anywhere state NEW ACCEPT all -- 192.168.245.8/29 anywhere state NEW REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT) target prot opt source destination root@ts:~#
您的规则可能会被错误地排列; 如果您不使用默认策略（为什么不？），那么订单就很重要。
显示什么iptables -L输出。
如果在WAN接口上设置REJECT默认策略，则只需要这3个协议的规则，而ESTABLISHED规则允许响应传出stream量。
当然，如果你有NAT的规则，大部分都会出来。
发现问题。
$IPT -A INPUT -j REJECT
应该
$IPT -i $WAN_NIC -A INPUT -j ACCEPT
或完全离开，因为我开始放弃一切，所以REJECT没有效果。