貌似可以接受的iptables规则阻止NIS（ypbind）运行

我不是iptables专家。

我有一个用例来阻止所有不指定为10.0.0.0/8或167.114.0.0/16的传出stream量。我有两个NIS服务器（10.57.132.11，10.57.132.40）。我生成了我认为可以工作的下面的iptables规则集，但是如果我运行service iptables start ，我无法也加载ypbind 。它击中了两个NIS服务器。除了超时之外，我在日志中什么也看不到。

# Generated by iptables-save v1.4.7 on Fri Jul 17 11:08:39 2015 *filter :INPUT ACCEPT [78622:10507056] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -I OUTPUT -d 10.57.132.11 -j ACCEPT -I OUTPUT -d 10.57.132.40 -j ACCEPT -I OUTPUT -d 167.114.0.0/16 -j ACCEPT -I OUTPUT -d 10.0.0.0/8 -j ACCEPT -P OUTPUT DROP COMMIT # Completed on Fri Jul 17 11:08:39 2015

任何想法，我在做什么错了？谢谢，杰克

更新：为了澄清，当iptablesclosures时，ypbind绑定，但是当我打开上面的规则集时不会绑定。由于它只是过滤OUTPUT，这些规则似乎是正确的，我不明白的问题，我找不到有用的日志。

tl; dr：iptables真的是字面上的，别忘了localhost的规则。

好的！得到它了。迈克尔汉普顿给了我使用logging规则的想法（这是我第一次）。所以我做了以下几点：

  Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.0.0.0/8 anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere 10.0.0.0/8 ACCEPT all -- anywhere 167.114.0.0/16 ACCEPT all -- anywhere nis1.example.com ACCEPT all -- anywhere nis2.example.com LOGGING all -- anywhere anywhere Chain LOGGING (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix `IPTables-Dropped: ' DROP all -- anywhere anywhere

从那里，我开始iptables，然后尝试重新启动ypbind，并立即看到这一点：

 Jul 22 22:53:04 host1 ypbind[9844]: Unable to register (YPBINDPROG, YPBINDVERS, udp). Jul 22 22:53:31 host1 kernel: IPTables-Dropped: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=1476 DF PROTO=TCP SPT=18660 DPT=7606 WINDOW=2305 RES=0x00 ACK URGP=0 Jul 22 22:53:50 host1 ypbind: NIS server for domain example is not responding. Jul 22 22:54:01 host1 kernel: IPTables-Dropped: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=1506 DF PROTO=TCP SPT=18660 DPT=7606 WINDOW=2305 RES=0x00 ACK URGP=0

不好了！这是阻止本地主机。我添加到输出规则，得到：

 Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.0.0.0/8 anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- localhost localhost ACCEPT all -- localhost localhost ACCEPT all -- localhost localhost ACCEPT all -- localhost localhost ACCEPT all -- anywhere 10.0.0.0/8 ACCEPT all -- anywhere 167.114.0.0/16 ACCEPT all -- anywhere nis1.example.com ACCEPT all -- anywhere nis2.example.com LOGGING all -- anywhere anywhere Chain LOGGING (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix `IPTables-Dropped: ' DROP all -- anywhere anywhere

还有一个ypbind重新启动

 Jul 22 22:54:38 host1 ypbind: NIS domain: example, NIS server: nis1.example.com

你有它！