Вопрос по iptables

iptables -F

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

Почему ко мне на компьютер не могут на 22 порт?

может твой провайдер блокирует?

Нет это в локальной сети, так и не могу панять в чем причина.

Стоп. Тормознул.

Ты по ssh хочешь зайти.

А сам демон запущен?

Покажи iptables -L

Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- localhost anywhere ACCEPT udp -- anywhere anywhere state ESTABLISHED udp spt:domain ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:3128 ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:http ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:ftp ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:ftp-data ACCEPT tcp -- anywhere anywhere tcp spt:ssh ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:smtp ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:pop3 ACCEPT icmp -- anywhere anywhere state ESTABLISHED icmp echo-reply LOG all -- anywhere anywhere LOG level warning

Chain FORWARD (policy DROP) target prot opt source destination LOG all -- anywhere anywhere LOG level warning

Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere localhost ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:domain ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:3128 ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:ftp ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:ftp-data ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:smtp ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:pop3 ACCEPT icmp -- anywhere anywhere state NEW,RELATED,ESTABLISHED icmp echo-request LOG all -- anywhere anywhere LOG level warning

sshd - запущен обязательно :), если сбросить все правила, и сделать политику ACCEPT, то все работает.

Забыл подписаться.

Stalcker

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- localhost anywhere
ACCEPT udp -- anywhere anywhere state ESTABLISHED udp spt:domain
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:3128
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:http
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:ftp
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:ftp-data
ACCEPT tcp -- anywhere anywhere tcp spt:ssh
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:smtp
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:pop3
ACCEPT icmp -- anywhere anywhere state ESTABLISHED icmp echo-reply
LOG all -- anywhere anywhere LOG level warning

Chain FORWARD (policy DROP)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere localhost
ACCEPT udp -- anywhere anywhere state NEW,RELATED,ESTABLISHED udp dpt:domain
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:3128
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:ftp-data
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW,RELATED,ESTABLISHED tcp dpt:pop3
ACCEPT icmp -- anywhere anywhere state NEW,RELATED,ESTABLISHED icmp echo-request
LOG all -- anywhere anywhere LOG level warning



sshd - запущен обязательно :), если сбросить все правила, и
сделать политику ACCEPT, то все работает.

Забыл подписаться.

Stalcker

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- localhost anywhere 
[skip]
ACCEPT tcp -- anywhere anywhere tcp spt:ssh 
                                    ^^^^
[/skip]

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere localhost 
[skip]
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh 
                                    ^^^^
[/skip]


наоборот должно быть

Спасибо, завтра попробую. Но, вопрос

ACCEPT tcp -- anywhere anywhere tcp spt:ssh
ACCEPT tcp -- anywhere anywhere state ESTABLISHED tcp spt:smtp
^^^^^^^
работает, т.е. по smtp почта забирается

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

Иеперь все работает.

а как это почта по smtp забирается?