添加规则后，Centos不会打开端口

所以经过一番与防火墙的对抗和挣扎后，我发现我可能正在做一些事情，或者防火墙没有正确响应，有一个阻塞某些端口的端口filter。

顺便说一下，我已经梳理了互联网，在论坛上发布，几乎所有事情都做了，现在网站名称“serverfault”，是我最后的手段，我需要帮助我希望实现的是创build一个pptp服务器连接到Windows / linux客户端

已更新@底部

好的，这是我做的：

• CentOS 6 LEMP更新 – 依赖性错误问题
• 我添加了一些选项来阻止与Postfix的垃圾邮件，但现在不会发送电子邮件到远程域
• 如何卸载`yum list`或`rpm -qa`中找不到的`php`？
• 缩小Linux分区和VM
• 如何读取“顶部”屏幕中显示的CPU使用情况统计信息？

我对我的iptables文件做了一些修改，给了我无尽的问题，所以我恢复了iptables.old文件

iptables.old的内容：

# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT 

在iptables.old恢复（回到股票）后，nmap扫描显示：

 nmap [server ip] Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 13:54 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.014s latency). Not shown: 997 filtered ports PORT STATE SERVICE 22/tcp open ssh 113/tcp closed ident 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 4.95 seconds 

如果我添加规则:(接受所有到接口eth0上的服务器的TCP端口）

 iptables -A INPUT -i eth0 -m tcp -j ACCEPT 

nmap输出：

 nmap [server ip] Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 13:58 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.017s latency). Not shown: 858 filtered ports, 139 closed ports PORT STATE SERVICE 22/tcp open ssh 443/tcp open https 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 3.77 seconds 

*注意，它允许和打开端口443，但没有其他端口，并删除端口113 …？

删除以前的规则，如果我追加规则：（允许并打开端口80传入服务器在接口eth0）

 iptables -A INPUT -i eth0 -m tcp -p tcp --dport 80 -j ACCEPT 

nmap输出：

 nmap [server ip] Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:01 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.014s latency). Not shown: 996 filtered ports PORT STATE SERVICE 22/tcp open ssh 80/tcp closed http 113/tcp closed ident 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 5.12 seconds 

*注意它删除端口443，并允许80，但被closures

而不删除以前的规则，如果我追加规则:(允许并打开端口1723传入服务器在接口eth0）

 iptables -A INPUT -i eth0 -m tcp -p tcp --dport 1723 -j ACCEPT 

nmap输出：

 nmap [server ip] Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:05 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.015s latency). Not shown: 996 filtered ports PORT STATE SERVICE 22/tcp open ssh 80/tcp closed http 113/tcp closed ident 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 5.16 seconds 

*通知没有改变港口开放或closures？

删除规则后：

 iptables -A INPUT -i eth0 -m tcp -p tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -m tcp -p tcp --dport 1723 -j ACCEPT 

nmap输出：

 nmap [server ip] Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:07 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.015s latency). Not shown: 998 filtered ports PORT STATE SERVICE 22/tcp open ssh 113/tcp closed ident Nmap done: 1 IP address (1 host up) scanned in 5.15 seconds 

并返回规则:(接受所有在接口eth0上传入服务器的tcp端口）

 iptables -A INPUT -i eth0 -m tcp -j ACCEPT 

nmap输出：

 nmap [server ip] Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:07 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.017s latency). Not shown: 858 filtered ports, 139 closed ports PORT STATE SERVICE 22/tcp open ssh 443/tcp open https 8008/tcp open http Nmap done: 1 IP address (1 host up) scanned in 3.87 seconds 

请注意eth0将999个已过滤的端口更改为858个已过滤的端口，已closures的139个端口

题：

为什么不能允许和/或打开一个特定的端口，例如。 我想允许和打开端口443，它不允许它，甚至1723的PPT，为什么我不能？

对于布局抱歉，编辑是给的问题（还有…感叹）

更新@Madhatter评论＃1

谢谢madhatter

在我的iptables文件中：

 # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i eth0 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT # ----------all rules mentioned in post where added here ONLY!!!---------- -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT 

如果我想允许并打开端口1723（或编辑iptables允许从远程pc的pptp连接），我会做出什么改变？ （请耐心等待，我第一次使用服务器等）

更新MadHatter评论＃2

 iptables -L -n -v --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 9 660 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 4 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 5 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 6 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 6 packets, 840 bytes) num pkts bytes target prot opt in out source destination 

就个人而言，madhatter，谢谢你的支持，我真的很感激！

更新MadHatter评论＃3

这里是接口

  ifconfig eth0 Link encap:Ethernet HWaddr 00:1D:D8:B7:1F:DC inet addr:[server ip] Bcast:[server ip xxx].255 Mask:255.255.255.0 inet6 addr: fe80::21d:d8ff:feb7:1fdc/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:36692 errors:0 dropped:0 overruns:0 frame:0 TX packets:4247 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2830372 (2.6 MiB) TX bytes:427976 (417.9 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 PtP:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) 

远程nmap

 nmap -p 1723 [server ip] Starting Nmap 6.00 ( http://nmap.org ) at 2013-11-01 16:17 SAST Nmap scan report for server.address.net ([server ip]) Host is up (0.017s latency). PORT STATE SERVICE 1723/tcp filtered pptp Nmap done: 1 IP address (1 host up) scanned in 0.51 seconds 

本地nmap

 nmap -p 1723 localhost Starting Nmap 5.51 ( http://nmap.org ) at 2013-11-01 16:19 SAST Nmap scan report for localhost (127.0.0.1) Host is up (0.000058s latency). Other addresses for localhost (not scanned): 127.0.0.1 PORT STATE SERVICE 1723/tcp open pptp Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds 

更新MadHatter COMMENT POST＃4

我很抱歉，如果可能有任何混淆，我确实附加了规则：（只有在第三后）

iptables -A INPUT -p tcp –dport 1723 -j ACCEPT

 netstat -apn|grep -w 1723 tcp 0 0 0.0.0.0:1723 0.0.0.0:* LISTEN 1142/pptpd 

服务器和“我”之间没有VPN和防火墙，

更新MadHatter评论＃5

所以这里是一个相互转变的事件：

我启动到Windows 7，创build一个VPN连接，通过validation用户名和Pword – >检查SSTP，然后检查PPT（经过这很快，哪些meeans没有问题），但在确定用户名和pword（之前注册networking上的电脑），它卡住了，给了这个错误

连接失败，错误2147943625远程计算机拒绝networking连接

netstat -apn | grep -w 1723

连接之前：

 netstat -apn |grep -w 1723 tcp 0 0 0.0.0.0:1723 0.0.0.0:* LISTEN 1137/pptpd 

之后错误再次尝试：

  netstat -apn |grep -w 1723 tcp 0 0 0.0.0.0:1723 0.0.0.0:* LISTEN 1137/pptpd tcp 0 0 41.185.26.238:1723 41.13.212.47:49607 TIME_WAIT - 

我不知道这是什么意思，但似乎有进步…，任何想法？