我是否需要为iptables上的传出规则设置源和目标端口的规则？

我正在使用puppetlabs防火墙模块，并且遇到了为简单的Web主机设置iptables的麻烦。

我遵循本指南并希望设置其他规则。 https://sysadmincasts.com/episodes/18-managing-iptables-with-puppet

例如，我已经添加了规则来允许使用git和mysql端口传出stream量：

firewall { '200 allow outgoing mysql': chain => 'OUTPUT', state => ['NEW'], proto => 'tcp', dport => '3306', action => 'accept', } firewall { '200 allow outgoing git': chain => 'OUTPUT', state => ['NEW'], dport => '9418', proto => 'tcp', action => 'accept', } 

并在iptables看，我可以看到以下规则：

• 在Puppet服务器上重复声明
• 恢复木偶configuration
• puppet中的资源types无效
• refreshonly不与傀儡exec资源工作
• 在木偶中使用生成（'…'）的例子

 root@app01:~/geppetto# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 /* 000 accept all icmp */ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 001 accept all to lo interface */ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 003 accept related established rules */ state RELATED,ESTABLISHED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80 /* 200 allow incoming http */ state NEW ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22 /* 200 allow openssh */ state NEW LOG all -- 0.0.0.0/0 0.0.0.0/0 /* 900 log dropped input chain */ LOG flags 0 level 6 prefix "[IPTABLES INPUT] dropped " DROP all -- 0.0.0.0/0 0.0.0.0/0 /* 910 deny all other input requests */ Chain FORWARD (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 /* 900 log dropped forward chain */ LOG flags 0 level 6 prefix "[IPTABLES FORWARD] dropped " DROP all -- 0.0.0.0/0 0.0.0.0/0 /* 910 deny all other forward requests */ Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 004 accept related established rules */ state RELATED,ESTABLISHED ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 53 /* 200 allow outgoing dns lookups */ state NEW ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 9418 /* 200 allow outgoing git */ state NEW ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80 /* 200 allow outgoing http */ state NEW ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 /* 200 allow outgoing icmp type 8 (ping) */ icmptype 8 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 3306 /* 200 allow outgoing mysql */ state NEW LOG all -- 0.0.0.0/0 0.0.0.0/0 /* 900 log dropped output chain */ LOG flags 0 level 6 prefix "[IPTABLES OUTPUT] dropped " DROP all -- 0.0.0.0/0 0.0.0.0/0 /* 910 deny all other output requests */ 

但是，我无法使用机器上的git访问任何内容。 运行git获取原点只是超时。 我是否也必须为输出源端口设置一些规则？ 提前致谢！