一个 iptables 的问题，求助下

Distributions

中文资源站

› 网易开源镜像站

This topic created in 791 days ago, the information mentioned may be changed or developed.

发现群晖的 iptables filter 表的规则是下面这样的(删了不相关的 chain)，按 archiwiki 来说，QUICKCONNECT_RELAY 最后一条 drop 后，后续的 rule 和 chain 都不会执行了，怎么一个群晖的 https 请求还能通过 QUICKCONNECT_RELAY 后继续执行 INPUT_FIREWALL ？

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
QUICKCONNECT_RELAY  all  --  anywhere             anywhere
INPUT_FIREWALL  all  --  anywhere             anywhere

Chain INPUT_FIREWALL (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
RETURN     udp  --  anywhere             anywhere             udp spt:41641
RETURN     tcp  --  anywhere             anywhere             multiport dports DSM-https,6690
RETURN     udp  --  anywhere             anywhere             udp dpt:41641
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain QUICKCONNECT_RELAY (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:6690
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:DSM-https
ACCEPT     icmp --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Supplement 1 · Apr 3, 2024

用 iptables -nvL 看，QUICKCONNECT_RELAY 最后的 drop 规则确实有网卡限制。

Chain QUICKCONNECT_RELAY (1 references)
 pkts bytes target     prot opt in     out     source               destination
43542   31M ACCEPT     tcp  --  tun1000 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:6690
22127 3997K ACCEPT     tcp  --  tun1000 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5001
  424 15264 ACCEPT     icmp --  tun1000 *       0.0.0.0/0            0.0.0.0/0
 2952  487K DROP       all  --  tun1000 *       0.0.0.0/0            0.0.0.0/0

iptables

QUICKCONNECT_RELAY

INPUT_FIREWALL

4 replies • 2024-04-02 10:14:19 +08:00