端口转发到OpenVPN连接一次，然后停止连接

我尝试通过OpenVPN连接（10.8.0.100）将IMAP和SMTP端口从外部IP地址（xxxx）转发到专用networking上的计算机。我目前有一个OpenVPN服务器（10.8.0.1），与外部IP（xxxx）在同一台机器上。

我使用从xxxx到10.8.0.100的iptables转发端口993,587和143，我可以通过telnet连接到外部的任何端口，并从内部IMAP和SMTP服务器获得响应，但是一旦closures连接，我无法重新连接一段时间（例如约30秒）。如果我尝试立即连接，它只是挂在那里，说：“尝试xxxx ..”，将不会连接。如果我停止尝试一段时间，然后重试，它会再次响应。但是如果我closures连接，它会再次发生。

如果我使用OpenVPN服务器本身，也会发生这种情况。如果我在端口143上telnet到10.8.0.100，假设它会连接，然后如果closures连接并再次尝试，它就在那里。

root@xxxx:~# telnet 10.8.0.100 143 Trying 10.8.0.100... Connected to 10.8.0.100. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN] Dovecot ready. d d BAD Error in IMAP command received by server. d d BAD Error in IMAP command received by server. d * BYE Too many invalid IMAP commands. Connection closed by foreign host. root@xxxx:~# telnet 10.8.0.100 143 Trying 10.8.0.100...

现在，如果我进入IMAP / SMTP服务器所在的专用networking中的计算机，我可以telnet到这些端口没有问题，closures它们，并尽快重新打开。

我一直在寻找几天来试图弥补这一点，但我似乎无法find有关这个问题的networking上的任何东西。任何帮助，将不胜感激。

更新添加iptables-save输出：

 ~# iptables-save # Generated by iptables-save v1.4.21 on Sat Sep 19 00:13:24 2015 *nat :PREROUTING ACCEPT [7476:440381] :INPUT ACCEPT [6361:381728] :OUTPUT ACCEPT [5842:414754] :POSTROUTING ACCEPT [5829:413974] -A PREROUTING -d xxxx/32 -p tcp -m tcp --dport 993 -j DNAT --to-destination 10.8.0.100:993 -A PREROUTING -d xxxx/32 -p tcp -m tcp --dport 587 -j DNAT --to-destination 10.8.0.100:587 -A PREROUTING -d xxxx/32 -p tcp -m tcp --dport 143 -j DNAT --to-destination 10.8.0.100:143 -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -d 10.8.0.100/32 -p tcp -m tcp --dport 993 -j SNAT --to-source 10.8.0.1:993 -A POSTROUTING -d 10.8.0.100/32 -p tcp -m tcp --dport 587 -j SNAT --to-source 10.8.0.1:587 -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE -A POSTROUTING -d 10.8.0.100/32 -p tcp -m tcp --dport 143 -j SNAT --to-source 10.8.0.1:143 -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE COMMIT # Completed on Sat Sep 19 00:13:24 2015 # Generated by iptables-save v1.4.21 on Sat Sep 19 00:13:24 2015 *filter :INPUT DROP [42:2113] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :ufw-after-forward - [0:0] :ufw-after-input - [0:0] :ufw-after-logging-forward - [0:0] :ufw-after-logging-input - [0:0] :ufw-after-logging-output - [0:0] :ufw-after-output - [0:0] :ufw-before-forward - [0:0] :ufw-before-input - [0:0] :ufw-before-logging-forward - [0:0] :ufw-before-logging-input - [0:0] :ufw-before-logging-output - [0:0] :ufw-before-output - [0:0] :ufw-logging-allow - [0:0] :ufw-logging-deny - [0:0] :ufw-not-local - [0:0] :ufw-reject-forward - [0:0] :ufw-reject-input - [0:0] :ufw-reject-output - [0:0] :ufw-skip-to-policy-forward - [0:0] :ufw-skip-to-policy-input - [0:0] :ufw-skip-to-policy-output - [0:0] :ufw-track-forward - [0:0] :ufw-track-input - [0:0] :ufw-track-output - [0:0] :ufw-user-forward - [0:0] :ufw-user-input - [0:0] :ufw-user-limit - [0:0] :ufw-user-limit-accept - [0:0] :ufw-user-logging-forward - [0:0] :ufw-user-logging-input - [0:0] :ufw-user-logging-output - [0:0] :ufw-user-output - [0:0] -A INPUT -j ufw-before-logging-input -A INPUT -j ufw-before-input -A INPUT -j ufw-after-input -A INPUT -j ufw-after-logging-input -A INPUT -j ufw-reject-input -A INPUT -j ufw-track-input -A INPUT -i eth0 -p tcp -m tcp --dport 993 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 587 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 143 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 10.8.0.0/24 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -j ufw-before-logging-forward -A FORWARD -j ufw-before-forward -A FORWARD -j ufw-after-forward -A FORWARD -j ufw-after-logging-forward -A FORWARD -j ufw-reject-forward -A FORWARD -j ufw-track-forward -A OUTPUT -j ufw-before-logging-output -A OUTPUT -j ufw-before-output -A OUTPUT -j ufw-after-output -A OUTPUT -j ufw-after-logging-output -A OUTPUT -j ufw-reject-output -A OUTPUT -j ufw-track-output -A OUTPUT -o eth0 -p tcp -m tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --sport 587 -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -o eth0 -p tcp -m tcp --sport 143 -m state --state ESTABLISHED -j ACCEPT -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT -A ufw-before-forward -j ufw-user-forward -A ufw-before-input -i lo -j ACCEPT -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny -A ufw-before-input -m conntrack --ctstate INVALID -j DROP -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT -A ufw-before-input -j ufw-not-local -A ufw-before-input -d yyyy/32 -p udp -m udp --dport 5353 -j ACCEPT -A ufw-before-input -d zzzz/32 -p udp -m udp --dport 1900 -j ACCEPT -A ufw-before-input -j ufw-user-input -A ufw-before-output -o lo -j ACCEPT -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ufw-before-output -j ufw-user-output -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] " -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN -A ufw-not-local -m limit --limit 30/min --limit-burst 10 -j ufw-logging-deny -A ufw-not-local -j DROP -A ufw-skip-to-policy-forward -j ACCEPT -A ufw-skip-to-policy-input -j DROP -A ufw-skip-to-policy-output -j ACCEPT -A ufw-track-forward -p tcp -m conntrack --ctstate NEW -j ACCEPT -A ufw-track-forward -p udp -m conntrack --ctstate NEW -j ACCEPT -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 1194 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 25 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 587 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 587 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 465 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 465 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 993 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 993 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 143 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 143 -j ACCEPT -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] " -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable -A ufw-user-limit-accept -j ACCEPT COMMIT

修复：我决定从一组干净的iptables规则开始，执行以下操作：

 iptables -F iptables --table nat --flush iptables --delete iptables --table nat --delete-chain iptables -F (maybe not necessary but did it at the end anyhow)

我决定禁用ufw并使用iptables在端口1194（OpenVPN端口）上允许udp。

 iptables -I INPUT -p udp -m udp --dport 1194 -j ACCEPT

然后使用https://unix.stackexchange.com/questions/76300/iptables-port-to-another-ip-port-from-the-inside作为我的指南，我做了以下工作：

 iptables -t nat -A PREROUTING -p tcp --dport 143 -d xxxx -j DNAT --to-destination 10.8.0.100 iptables -t nat -A POSTROUTING -p tcp --dport 143 -d 10.8.0.100 -j SNAT --to-source 10.8.0.1 iptables -A FORWARD -p tcp --dport 143 -d 10.8.0.100 -j ACCEPT

现在，我可以telnet到端口143，closures连接，立即重新打开连接，无需等待。我为所有的IMAP（S）和SMTP（S）端口做了这个。