运行时，我的Ubuntu服务器降低了互联网连接速度

我有Ubuntu 16.04服务器运行LAMP phpmyadmin。我已经安装了git和一个crontab将它自动装载到云端。我的问题是当服务器运行时，我无法在任何其他设备上使用互联网。我有一个戴尔Optiplex GX620。任何帮助，将不胜感激。我跑了iftop，并发现以下IP地址有一个急剧增加的TXstream量。

116.211.144.72
183.60.203.94
61.164.158.91
119.167.139.11
122.228.29.172
219.128.79.112
122.228.29.40
219.128.79.112
103.5.58.234
183.131.212.73
183.60.133.135
183.131.49.38
59.56.66.32
211.99.224.235

我似乎每分钟都会得到一个新的IP地址。我查过的那些是来自中国，但是我在美国。我能想到的唯一的stream量是Codeanywhere，github / git和No-ip。有没有办法阻止来自中国的交通？因为我的连接是光纤，所以我有100Mbps的速度。你也认为这是我列出的任何服务？

编辑：

root@buntubox-1:~# netstat -nputwa Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 972/mysqld tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 896/sshd tcp 0 1 192.168.1.99:52398 198.204.254.253:8623 SYN_SENT 1207/sshd tcp 0 296 192.168.1.99:22 192.168.1.50:55597 ESTABLISHED 14947/0 tcp 0 0 192.168.1.99:47616 164.132.4.3:6000 ESTABLISHED 928/bash tcp6 0 0 :::80 :::* LISTEN 1198/apache2 tcp6 0 0 :::22 :::* LISTEN 896/sshd

…

 root@buntubox-1:~# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination

更新：

我已经重新安装了操作系统。以下好吗？

 root@buntubox-001:~# iptables -L Chain INPUT (policy DROP) target prot opt source destination f2b-sshd tcp -- anywhere anywhere multiport dports ssh ufw-before-logging-input all -- anywhere anywhere ufw-before-input all -- anywhere anywhere ufw-after-input all -- anywhere anywhere ufw-after-logging-input all -- anywhere anywhere ufw-reject-input all -- anywhere anywhere ufw-track-input all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination ufw-before-logging-forward all -- anywhere anywhere ufw-before-forward all -- anywhere anywhere ufw-after-forward all -- anywhere anywhere ufw-after-logging-forward all -- anywhere anywhere ufw-reject-forward all -- anywhere anywhere ufw-track-forward all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ufw-before-logging-output all -- anywhere anywhere ufw-before-output all -- anywhere anywhere ufw-after-output all -- anywhere anywhere ufw-after-logging-output all -- anywhere anywhere ufw-reject-output all -- anywhere anywhere ufw-track-output all -- anywhere anywhere Chain f2b-sshd (1 references) target prot opt source destination RETURN all -- anywhere anywhere Chain ufw-after-forward (1 references) target prot opt source destination Chain ufw-after-input (1 references) target prot opt source destination ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST Chain ufw-after-logging-forward (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] " Chain ufw-after-logging-input (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] " Chain ufw-after-logging-output (1 references) target prot opt source destination Chain ufw-after-output (1 references) target prot opt source destination Chain ufw-before-forward (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp source-quench ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ufw-user-forward all -- anywhere anywhere Chain ufw-before-input (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-logging-deny all -- anywhere anywhere ctstate INVALID DROP all -- anywhere anywhere ctstate INVALID ACCEPT icmp -- anywhere anywhere icmp destination-unreachable ACCEPT icmp -- anywhere anywhere icmp source-quench ACCEPT icmp -- anywhere anywhere icmp time-exceeded ACCEPT icmp -- anywhere anywhere icmp parameter-problem ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc ufw-not-local all -- anywhere anywhere ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900 ufw-user-input all -- anywhere anywhere Chain ufw-before-logging-forward (1 references) target prot opt source destination Chain ufw-before-logging-input (1 references) target prot opt source destination Chain ufw-before-logging-output (1 references) target prot opt source destination Chain ufw-before-output (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ufw-user-output all -- anywhere anywhere Chain ufw-logging-allow (0 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] " Chain ufw-logging-deny (2 references) target prot opt source destination RETURN all -- anywhere anywhere ctstate INVALID limit: avg 3/min burst 10 LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] " Chain ufw-not-local (1 references) target prot opt source destination RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10 DROP all -- anywhere anywhere Chain ufw-reject-forward (1 references) target prot opt source destination Chain ufw-reject-input (1 references) target prot opt source destination Chain ufw-reject-output (1 references) target prot opt source destination Chain ufw-skip-to-policy-forward (0 references) target prot opt source destination DROP all -- anywhere anywhere Chain ufw-skip-to-policy-input (7 references) target prot opt source destination DROP all -- anywhere anywhere Chain ufw-skip-to-policy-output (0 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain ufw-track-forward (1 references) target prot opt source destination Chain ufw-track-input (1 references) target prot opt source destination Chain ufw-track-output (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere ctstate NEW ACCEPT udp -- anywhere anywhere ctstate NEW Chain ufw-user-forward (1 references) target prot opt source destination Chain ufw-user-input (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT udp -- anywhere anywhere udp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT udp -- anywhere anywhere udp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:http /* 'dapp_Apache' */ Chain ufw-user-limit (0 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] " REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain ufw-user-limit-accept (0 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain ufw-user-logging-forward (0 references) target prot opt source destination Chain ufw-user-logging-input (0 references) target prot opt source destination Chain ufw-user-logging-output (0 references) target prot opt source destination Chain ufw-user-output (1 references) target prot opt source destination

编辑

现在你已经重新安装并获得了防火墙，我build议你考虑以下几点：

你曾经从它所托pipe的networking之外访问服务器吗？如果没有，请不要将任何端口从您的路由器转发到服务器 – 它不需要接受来自Internet的入站连接。
考虑安装ClamAV并将其configuration为每晚运行。
安装RKHunter并将其configuration为每晚运行。
考虑安装ChRootKit并让它每晚运行。
安装fail2ban监视SSH的尝试，它也可以用来缓解MySQL / PHPMyAdmin和Apache暴力攻击 – 你可以忽略这篇文章的基本防火墙部分，因为你已经有了这个sorting。
考虑每天安装LogWatch并查看日志。
安装OSSEC-HIDS – 这个和fail2ban＆RKHunter是我会推荐的主要的。 Ossec会检测入侵，它会检测文件的变化，它旨在告诉你什么时候以及如何被黑客入侵。
安装和运行Lynsis审计，这将提出一些方法来加强你的安全性，如果你真的偏执狂，通过他们工作，打勾尽可能多的。
禁止通过SSH进行rootlogin ，并使用密钥authentication。

希望有所帮助，还有更多的事情可以做，永远都有，而且你永远不可能完全安全，这只是让事情变得更加困难，然后减轻损害。备份，将重要日志复制到其他服务器，不要公开您不需要的端口，更改默认的解除屏蔽…列表继续，但如果您只是在玩耍，上面应该已经足够了。如果你想要更多，谷歌是你的朋友，这是一个很好的先发。就这样。而这个。

原始答案：

理想情况下，你想知道连接被连接到什么进程，netstat可以告诉你。

 netstat -nputwa

这将输出每个连接，TCP / UDP，input/输出，并显示您负责的IP和它所连接的进程。如果你确定一个IP连接到一个进程，它不应该/不需要，只需在防火墙级别阻止它。

如果你想帮助解密它，把你的问题的命令输出作为编辑。

编辑：你没有防火墙。

下面会让你开始，创build一个新的文件/etc/iptables.firewall.rules并粘贴到它：

 *filter # Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0 -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/8 -j REJECT # Accept all established inbound connections -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow all outbound traffic - you can modify this to only allow certain traffic -A OUTPUT -j ACCEPT # Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL). -A INPUT -p tcp --dport 80 -j ACCEPT -A INPUT -p tcp --dport 443 -j ACCEPT # Allow SSH connections # The -dport number should be the same port number you set in sshd_config -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT # Allow ping -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # Log iptables denied calls -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 # Drop all other inbound - default deny unless explicitly allowed policy -A INPUT -j DROP -A FORWARD -j DROP COMMIT

保存文件并运行iptables-restore < /etc/iptables.firewall.rules

您还需要确保规则在引导时生效，为此，请在/etc/network/if-pre-up.d/firewall创build一个文件并添加到该文件中：

 #!/bin/sh /sbin/iptables-restore < /etc/iptables.firewall.rules

然后最后运行：

  chmod +x /etc/network/if-pre-up.d/firewall

这会让你开始，你需要做更多的iptables的研究，特别是“允许所有出站stream量 – 你可以修改这个只允许一定的stream量” – 我build议你把它locking只允许http和ssh。这篇文章的底部有一个脚本，其中的命令解释了如何做到这一点。

另外，请看安装Fail2Ban和OSSEC – 这些是攻击缓解和入侵检测系统。此外，像Logwatch这样的东西可以帮助监视，每日rootkit扫描，而不是打开你的服务器到互联网，如果它不需要。

如果您认为自己遭到了黑客入侵，那么备份文件和重新安装操作系统是最简单的 – 这一次从第一天开始正确设置您的安全性。如果您感觉幸运，那么实施上述措施并阻止您觉得有风险的IP在防火墙级别。

 iptables -A INPUT -s <ip to block> -j DROP

请注意，每次添加新文件时，请备份您的文件墙，以保持其持久性。

 iptables-save > /etc/iptables.firewall.rules

对你来说另一个好主意是使用htop / top来查看系统上运行的进程 – 做任何看起来可疑的事情？尝试运行RootkitHunter和CHRootKit – 他们是否会出现任何结果？如果是这样 – 擦拭并重新开始。

另一个好主意，一般来说，当要保护服务器时，运行Lynsis Audit，它会build议你采取步骤。

顺便说一句，你说你每分钟都会得到一个新的IP–这仍然是这样吗？如果是，请继续重新运行netstat命令，正在使用哪个进程？看看你的日志，你能看到请求进来吗？如果是的话，他们在做什么？

 tail -f /var/log/auth.log tail -f /var/log/syslog

最后，请参阅您的问题下的评论，说明如果您遭到黑客入侵，该做什么，无论您是否有非常好的阅读。

“”有没有办法阻止来自中国的交通？“”

是的，例如，你可以使用iptables来黑名单这些IP范围： http : //www.nirsoft.net/countryip/cn.html （我只是GOOGLE中国IP块列表）