請教 Linux iptables 熟手,設定方法
 

Linux Fedora 8 IPTABLE設定值:
主機:
1. 外網 只要開放 20,21,22,53,953,(ftp,ssh,mail)
2.內網 只開放 445,139(smb)
3.沒有架設　NAT

問題:
1./var/log/messages 內一直出上百條以下的訊設,以下略取10條,
2.如果設了以下 IPTABLES規則,DNS 會無法運作,

請教iptables 熟手,是什麼問題,還是有更好設定的方法呢? 感恩也 謝謝~

有去爬了一些文,是說要加以下的資料到 named.conf,試了之後,反而DNS 起不來
logging {
category lame-servers {null; };
category edns-disabled { null; };
};


[B]IPTables 的設定值:[/B]
#=======================InSiteNet eth1(192.168.0.5)=====================
#------------------------------SMB ACCEPT-----------------------
-A INPUT -p tcp -i eth1 -m state --state RELATED -d 192.168.0.5 -m multiport --dports 445,139 -j ACCEPT
-A INPUT -p udp -i eth1 -m state --state RELATED -d 192.168.0.5 -m multiport --dports 445,137:138 -j ACCEPT
#=======================OutSiteNet eth0(220.128.122.86)=====================
#-----------------------SSH--------------------------------------

-A INPUT -i eth0 -p tcp -s 222.222.222.22-m multiport --dports 22 -j ACCEPT
-A INPUT -i eth0 -p udp -s 222.222.222.22 -m multiport --dports 22 -j ACCEPT
#--------------------------------------------------------------
-A OUTPUT -o eth0 -p tcp -j ACCEPT
-A OUTPUT -o eth0 -p udp -j ACCEPT

#------------------------------DNS ACCEPT
-A INPUT -p udp -m multiport --sports 53,953 -m multiport --dports 53,953 -j ACCEPT
-A INPUT -p tcp -m multiport --sports 53,953 -m multiport --dports 53,953 -j ACCEPT

#------------------------------Mail ACCEPT
-A INPUT -p tcp -i eth0 -d 222.222.222.22-m multiport --dports 110,25 -j ACCEPT
-A INPUT -p udp -i eth0 -d 222.222.222.22 -m multiport --dports 110,25 -j ACCEPT

#-----------------------------Vsftpd accept
-A INPUT -p tcp -i $EXTIF -s 220.128.122.85 --dport 21 -j ACCEPT
-A INPUT -p tcp -i $EXTIF -s 220.128.122.85 --dport 60000:60010 -j ACCEPT

#______________________Server Port 1:1023 LOG
#-A INPUT -i eth0 -p tcp -m state --state NEW,ESTABLISHED --dport 1:1023 --sport 1:65535 -j LOG
#-A INPUT -i eth0 -p udp -m state --state NEW,ESTABLISHED --dport 1:1023 --sport 1:65535 -j LOG

#---------------------------OutPut Port------------------------
-A OUTPUT -o eth0 -p tcp --sport 80 -j DROP
-A INPUT -i eth0 -p tcp -d 222.222.222.22 --dport 1024:65535 -j DROP
-A INPUT -i eth0 -p udp -d 222.222.222.22 --dport 1024:65535 -j DROP



[B]/var/log/messages 內[/B]y 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'H.GTLD-SERVERS.NET/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'I.GTLD-SERVERS.NET/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'J.GTLD-SERVERS.NET/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'K.GTLD-SERVERS.NET/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'B.DNS.tw/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'E.DNS.tw/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'F.DNS.tw/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'G.DNS.tw/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'H.DNS.tw/AAAA' (in '.'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'fedora.mirrors.firstnetcom.com.tw.tw/A' (in 'tw'?): disabling EDNS
May 24 21:07:23 fortune-s named[6999]: too many timeouts resolving 'NS.TWNIC.NET/AAAA' (in 'NET'?): disabling EDNS
May 24 21:07:24 fortune-s named[6999]: too many timeouts resolvin

回覆: 請教 Linux iptables 熟手,設定方法
 

您不覺得 iptables過濾的條件有問題嘛!?
您的dport和sport寫在同一條規則內
那...連線時 真的是照如此嘛!?^^

回覆: 請教 Linux iptables 熟手,設定方法
 

可以也.只是縮小規則的範圍,我也看很多IPTABLES技術文章,才知可以這樣設,也沒出現錯誤訊息:)

回覆: 請教 Linux iptables 熟手,設定方法
 

看起來像是你的DNS沒有辦法對root DNS作query.

回覆: 請教 Linux iptables 熟手,設定方法
 

iptables -A INPUT -i eth0 -p udp --sport 53 --dport 1024:65535 -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --sport 53 --dport 1024:65535 -j ACCEPT

=============
明顯的是DNS的RULE有問題
DNS INPUT改成這樣試試

參考資料
[url]http://linux.tnc.edu.tw/techdoc/firewall/iptables-intro.html[/url]

回覆: 請教 Linux iptables 熟手,設定方法
 

把 rules 全砍了
用 X-Window 中的介面去重新設定