如何设置IPTables以允许TCP端口599？

我是IPTables的新手，我相信我忽视了一些显而易见的东西。

这是我的设置：

Chain INPUT (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere state NEW recent: UPDATE seconds: 60 hit_count: 12 name: DEFAULT side: source mask: 255.255.255.255 all -- anywhere anywhere state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere state INVALID ACCEPT udp -- anywhere anywhere udp dpt:isakmp ACCEPT udp -- anywhere anywhere udp dpt:ipsec-nat-t DROP all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- ip-10-10-10-0.ap-south-1.compute.internal/24 anywhere policy match dir in pol ipsec proto esp ACCEPT all -- anywhere ip-10-10-10-0.ap-south-1.compute.internal/24 policy match dir out pol ipsec proto esp DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination

然后我试图打开599端口：

 sudo iptables -A INPUT -p tcp --dport 599 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT sudo iptables -A OUTPUT -p tcp --sport 599 -m conntrack --ctstate ESTABLISHED -j ACCEPT

不幸的是，我现有的IPTables仍然阻止它，我不明白为什么。 AWS健康检查仍然无法在599端口上进行TCP ping。任何线索什么我失踪？

最新更新：

 sudo iptables -vnL --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 11582 695K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:599 ctstate NEW,ESTABLISHED 2 309K 19M DROP all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW recent: UPDATE seconds: 60 hit_count: 12 name: DEFAULT side: source mask: 255.255.255.255 3 6546 386K all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW recent: SET name: DEFAULT side: source mask: 255.255.255.255 4 11329 7186K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 5 24 1440 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:599 ctstate NEW,ESTABLISHED 6 246 13224 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 7 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 8 50 2227 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 9 2 400 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:500 10 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:4500 11 6275 371K DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT all -- * * 10.10.10.0/24 0.0.0.0/0 policy match dir in pol ipsec proto 50 2 0 0 ACCEPT all -- * * 0.0.0.0/0 10.10.10.0/24 policy match dir out pol ipsec proto 50 3 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 18608 packets, 2153K bytes) num pkts bytes target prot opt in out source destination

那么，iptables -A INPUT将规则追加到最后。您目前的最后一条规则是：

DROP all -- anywhere anywhere

所以，它被添加到最后，放下规则后，永远不会达成。您将需要使用行号列出规则：

iptables -nL --line-numbers

然后使用iptables -I INPUT 5 ... （或任何行号）在特定位置添加。

如果端口599的所有stream量都被允许退出（使用NEW，ESTABLISHED），所以您不需要OUTPUT规则。

如果这是在一个EC2实例上运行，你也要确保安全组也允许599。尽pipe使用aws安全组，个别实例上的iptables可能不是必须的。