Question

我安装了Gitlab-Omnibus软件包并为端口80,443,9418和temp打开了iptables。即使是22.为什么不通过https工作？当我把iptables打开默认打开它的一切工作。以下是我对80,443,22和9418的规定

# 1. Allow incoming HTTP
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport 80 -j ACCEPT

# 2. Allow outgoing HTTP
$IPTABLES -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 80 -j ACCEPT

# Allow incoming HTTPS
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport 443 -j ACCEPT

# 10. Allow outgoing HTTPS
$IPTABLES -A OUTPUT -p tcp --dport 443 -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 443 -j ACCEPT

# allow git
$IPTABLES -A OUTPUT -p tcp --dport 9418 -j ACCEPT
$IPTABLES -A INPUT -p tcp --sport 9418 -j ACCEPT

#SSH: Client --> Server
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport 22 -j ACCEPT

结果是：

Pushing to https://TLD/USER/REPO.git
POST git-receive-pack (448 bytes)

然后就冻结了。我还需要打开其他什么？

我尝试记录丢弃的软件包，但我的ip没有任何内容？

我希望有人可以帮助我..

这里是我的日志规则：

#Logging
$IPTABLES -N LOGGING
$IPTABLES -A INPUT -j LOGGING
$IPTABLES -A OUTPUT -j LOGGING
$IPTABLES -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
$IPTABLES -A LOGGING -j DROP

这是输出：

# Generated by iptables-save v1.4.21 on Thu Nov 13 18:43:13 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOGGING - [0:0]
-A INPUT -p icmp -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 443 -j ACCEPT
-A INPUT -s 10.20.0.0/16 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 37655 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 9418 -j ACCEPT
-A INPUT -j LOGGING
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -d 10.20.0.0/16 -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 37655 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9418 -j ACCEPT
-A OUTPUT -j LOGGING
-A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: "
-A LOGGING -j DROP
-A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: "
-A LOGGING -j DROP
-A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: "
-A LOGGING -j DROP
-A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: "
-A LOGGING -j DROP
COMMIT

Answer 1

#Devices
DEV0=eth0

#internal network
INT_NET=xxx.xxx.0.0/16
INT_NET_SECURE=xxx.xxx.xxx.0/24

#external network
EXT_NET=xxx.xxx.xxx.0/24

#path iptables
IPTABLES=/sbin/iptables
#path modprobe
MODPROBE=/sbin/modprobe



case $1 in
        start)
        $0 stop

        echo "start ip-package-filter"

        # iptables-Modul
        $MODPROBE ip_tables

        # Connection-Tracking-Module
        $MODPROBE ip_conntrack
        $MODPROBE ip_conntrack_ftp 
        $MODPROBE ip_nat_ftp 
        $MODPROBE iptable_nat 

        #Standard-Policy - Deny everything except what we want
        $IPTABLES -P INPUT DROP
        $IPTABLES -P OUTPUT DROP
        $IPTABLES -P FORWARD DROP

        #slows down icmp for too much packages
        echo "5" >/proc/sys/net/ipv4/icmp_ratelimit


        #Kills packages with source route option
        echo "0">/proc/sys/net/ipv4/conf/$DEV0/accept_source_route
        #Kills icmp forwarding
        echo "0">/proc/sys/net/ipv4/conf/$DEV0/accept_redirects
        #Kills spoofed packages
        echo "1" > /proc/sys/net/ipv4/conf/$DEV0/rp_filter

        #Kills packages from 0.X.X.X
        echo "0" > /proc/sys/net/ipv4/conf/eth0/bootp_relay
        # TCP-FIN-Timeout (DoS-Attack)
        echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
        #TCP-SYN max 3 answers
        echo 3 > /proc/sys/net/ipv4/tcp_retries1
        #TCP-Package max 15x repetitions
        echo 15 > /proc/sys/net/ipv4/tcp_retries2


        #Loopback-Communication
        $IPTABLES -A INPUT -i lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT 
        $IPTABLES -A OUTPUT -o lo -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT 

        #ICMP: Client <--> Server
        $IPTABLES -A INPUT -p icmp --icmp-type echo-request -m state --state NEW -j ACCEPT
        $IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -m state --state NEW -j ACCEPT

        #DNS: Server --> DNS-Server
        $IPTABLES -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT
        $IPTABLES -A OUTPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT


        # Allow incoming HTTP
        $IPTABLES -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

        # Allow incoming HTTPS
        $IPTABLES -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

        #SSH: Client --> Server (internal)
        $IPTABLES -A INPUT -s $INT_NET -p tcp --dport 22 -m state --state NEW -j ACCEPT


        #SSH: Client --> Server
        #$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
        #$IPTABLES -A OUTPUT -p tcp --sport 22 -j ACCEPT

        #Update (apt)
        $IPTABLES -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

        #TeamDrive
        $IPTABLES -A INPUT -p tcp --dport 37655 -m state --state NEW -j ACCEPT

        #Git
        $IPTABLES -A INPUT -p tcp --dport 9418 -m state --state NEW -j ACCEPT


        #Connection-Tracking for INPUT and OUTPUT CHAIN
        $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

        #Logging
        $IPTABLES -N LOGGING
        $IPTABLES -A INPUT -j LOGGING
        $IPTABLES -A OUTPUT -j LOGGING
        $IPTABLES -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 4
        $IPTABLES -A LOGGING -j DROP



                echo "Firewall activated"

        ;;

        stop)
                $IPTABLES -F INPUT
                $IPTABLES -F OUTPUT
                $IPTABLES -F FORWARD
        ;;

        restart)
                $0 start
        ;;

        *)
                echo "Usage: $0 {startwd|stop|restart}"
        ;;

esac

由于iptables，通过https推送的Gitlab不成功

1 个答案: