[问题求助]iptables help!!! [复制链接]

iptables -A INPUT -i eth0 -.m mac --mac-source 00:0.4:23:17:A5:8D -p tcp --dport 6667 -j AC.CEPT             汽车

命令执行完毕后没有报错

ipta.bles -L INPUT.


A.CCEPT     al.l  --  anywher.e             anywhere           MAC 00:04:23:17:A5:8D 外贸

看上去也是正常。

但是port 6667 还是不能.访问，请高人指点健康

还有一个udp吧

我去试试看。

ALSO CANNOT

iptables-save 帖上来看看。

# Generated by iptables-save v1.2.6a on Wed Feb 18 08:09:46 2004
*nat
REROUTING ACCEPT [3467]
OSTROUTING ACCEPT [84]
:OUTPUT ACCEPT [120]
-A PREROUTING -i eth+ -p icmp -j ACCEPT
COMMIT
# Completed on Wed Feb 18 08:09:46 2004
# Generated by iptables-save v1.2.6a on Wed Feb 18 08:09:46 2004
*filter
:INPUT DROP [202]
:FORWARD DROP [0]
:OUTPUT DROP [0]
:syn-flood - [0]
-A INPUT -i eth0 -p tcp -m tcp --dport 6667 -j LOG --log-prefix "IRC:"
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j syn-flood
-A INPUT -i eth+ -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i eth+ -f -j LOG --log-prefix "IPT FRAGMENTS: "
-A INPUT -i eth+ -f -j DROP
-A INPUT -i eth+ -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 67 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 67 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 443 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 21 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 21 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 23 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 23 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 25 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 25 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 110 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 110 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 10.10.10.0/255.255.255.0 -i eth+ -p tcp -m tcp --dport 6667 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p icmp -j ACCEPT
-A INPUT -i eth+ -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -m mac --mac 00:04:23:17:A5:8D -j ACCEPT
-A FORWARD -i eth0 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 21 -j LOG --log-prefix "IPT FTP FWD pkt: " --log-level 6
-A FORWARD -i eth+ -p tcp -m tcp --dport 21 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --dport 20 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --dport 23 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -i eth+ -p tcp -m tcp --dport 6667 -j ACCEPT
-A FORWARD -i eth0 -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FWD packet died: " --log-level 6
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --sport 67 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 68 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 67 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 68 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 21 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 21 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 23 -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 23 -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 25 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 25 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 110 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 110 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 6667 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --sport 113 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p tcp -m tcp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --dport 113 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth+ -p udp -m udp --sport 32769:65535 --dport 33434:33523 -m state --state NEW -j ACCEPT
-A OUTPUT -o eth+ -p icmp -j ACCEPT
-A syn-flood -m limit --limit 1/sec --limit-burst 4 -j RETURN
-A syn-flood -j DROP
COMMIT
# Completed on Wed Feb 18 08:09:46 2004

-m mac --mac-source 00:04:23:17:A5:8D
是只要这一台可以访问吗？

我没细看，因为太多了。

不过，你的前面是 INPUT DROP;OUTPUT DROP;FORWARD DROP.你DROP了那么多，你只给了那个MAC INPUT，没给OUTPUT吧？试试加上OUTPUT。