LinuxForum.Fans
Тема

Проблема с портами

Автор: 4fun 22 сообщений 3936 просмотров
26.05.2011 12:48 · отредактировано #165055

ОС: CentOS 5.5
Проблема заключается в следующем: при попытке запустить сервер cs пишет, что порт, на котором пытаюсь запустить, уже занят.
Но он не может быть занят, т.к. сервер на нем работал и после ребута начались подобные проблемы. При попытке запустить на любом другой порту, получаю такой же результат. На другой серверной машине стоит такая же ОСь, такая же сборка самого сервера cs, но проблем не возникает. Есть у кого-то мысли по этому поводу? Заранее спасибо.

26.05.2011 12:55 #165057
4fun написал:
Но он не может быть занят

lsof -i
покажет, кто его занял.

26.05.2011 13:50 #165077
drBatty написал:
[quote=4fun]Но он не может быть занят

lsof -i
покажет, кто его занял.[/quote]
Все, спасибо, проблему нашел

26.05.2011 13:53 #165079

вдогонку

[console]# lsof -i :6666[/console]
покажет, кто висит на порту 6666

27.05.2011 23:18 #165568

в iptables порт открыт

text
    # Generated by iptables-save v1.4.10 on Fri May 27 21:07:35 2011
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [7:609]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 65399 -j ACCEPT
    -A INPUT -p udp -m state --state NEW -m udp --dport 65399 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT
    # Completed on Fri May 27 21:07:35 2011

transmission и треккер показывают что порт закрыт. модемов и роутеров нет. в чём может быть проблема?

27.05.2011 23:21 #165569

wers, по аналогии с предыдущими постами покажите вывод команды
[console]lsof -i :65399[/console]

27.05.2011 23:24 #165571

wers, и
[console]
grep 'peer-port' ~/.config/transmission/settings.json
[/console]

27.05.2011 23:27 #165573

вот;

text
[user@localhost ~]$ lsof -i :65399
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
transmiss 1918 user   13u  IPv4  23900      0t0  TCP *:65399 (LISTEN)
transmiss 1918 user   14r  IPv6  23902      0t0  TCP *:65399 (LISTEN)
transmiss 1918 user   15w  IPv4  23903      0t0  UDP *:65399 
[user@localhost ~]$ grep 'peer-port' ~/.config/transmission/settings.json
    "peer-port": 65399, 
    "peer-port-random-high": 65535, 
    "peer-port-random-low": 49152, 
    "peer-port-random-on-start": false,
27.05.2011 23:30 #165574
wers написал:
transmission и треккер показывают что порт закрыт. модемов и роутеров нет. в чём может быть проблема?

А какое у вас подключение? Треккер внешний либо в локальной сети?

27.05.2011 23:35 · отредактировано #165576

подключён по кабелю. и на внешке и на локалке закрыт. утром слез с убунту, всё было нормально

27.05.2011 23:45 #165579
wers написал:
и на внешке и на локалке закрыт.

Что-то я несколько запутался... Что значит «и на внешке и на локалке закрыт»?
Опишите, на какой машине поднят сервер, откуда пытаетесь подключиться клиентом? Или вы подключаетесь через веб-интерфейс?

27.05.2011 23:50 · отредактировано #165580

машина не сервер. домашний комп. просто торрент клиент пишет что порт закрыт, нет раздачи ни на локальном треккере ни на внешних треккерах. забыл сказать, фаервол отключаю порт открывается.

28.05.2011 00:12 #165583

wers, не могли бы вы показать полностью скрипт, запускающий firewall?

28.05.2011 00:37 #165585

iptables.sh

Показать
text
#!/bin/sh
#
# iptables    Start iptables firewall
#
# chkconfig: 2345 08 92
# description:    Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
#
### BEGIN INIT INFO
# Provides: iptables
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop iptables firewall
# Description: Start, stop and save iptables firewall
### END INIT INFO

# Source function library.
. /etc/init.d/functions


IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES


if [ ! -x /sbin/$IPTABLES ]; then
    echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
    exit 5
fi


# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS=1 \
    || NEW_MODUTILS=0


# Default firewall configuration:
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"


# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"


# Netfilter modules
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6


# Get active tables
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)


rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$1
    local ret=0
    local ref=


    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS = 1 ] \
    && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
    || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)


    # recursive call for all referring modules
    for i in $ref; do
    rmmod_r $i
    let ret+=$?;
    done


    # Unload module.
    # The extra test is for 2.6: The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
    modprobe -r $mod > /dev/null 2>&1
    res=$?
    [ $res -eq 0 ] || echo -n " $mod"
    let ret+=$res;
    fi


    return $ret
}


flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0


    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 1


    echo -n $"${IPTABLES}: Flushing firewall rules: "
    ret=0
    # For all tables
    for i in $NF_TABLES; do
        # Flush firewall rules.
    $IPTABLES -t $i -F;
    let ret+=$?;


        # Delete firewall chains.
    $IPTABLES -t $i -X;
    let ret+=$?;


    # Set counter to zero.
    $IPTABLES -t $i -Z;
    let ret+=$?;
    done


    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}


set_policy() {
    # Set policy for configured tables.
    policy=$1


    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0


    # Check if firewall is configured (has tables)
    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
    [ -z "$tables" ] && return 1


    echo -n $"${IPTABLES}: Setting chains to policy $policy: "
    ret=0
    for i in $tables; do
    echo -n "$i "
    case "$i" in
        raw)
        $IPTABLES -t raw -P PREROUTING $policy \
            && $IPTABLES -t raw -P OUTPUT $policy \
            || let ret+=1
        ;;
        filter)
                $IPTABLES -t filter -P INPUT $policy \
            && $IPTABLES -t filter -P OUTPUT $policy \
            && $IPTABLES -t filter -P FORWARD $policy \
            || let ret+=1
        ;;
        nat)
        $IPTABLES -t nat -P PREROUTING $policy \
            && $IPTABLES -t nat -P POSTROUTING $policy \
            && $IPTABLES -t nat -P OUTPUT $policy \
            || let ret+=1
        ;;
        mangle)
            $IPTABLES -t mangle -P PREROUTING $policy \
            && $IPTABLES -t mangle -P POSTROUTING $policy \
            && $IPTABLES -t mangle -P INPUT $policy \
            && $IPTABLES -t mangle -P OUTPUT $policy \
            && $IPTABLES -t mangle -P FORWARD $policy \
            || let ret+=1
        ;;
        *)
            let ret+=1
        ;;
        esac
    done


    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}


start() {
    # Do not start if there is no config file.
    [ ! -f "$IPTABLES_DATA" ] && return 6


    # check if ipv6 module load is deactivated
    if [ "${_IPV}" = "ipv6" ] \
    && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
    echo $"${IPTABLES}: ${_IPV} is disabled."
    return 150
    fi


    echo -n $"${IPTABLES}: Applying firewall rules: "


    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"


    $IPTABLES-restore $OPT $IPTABLES_DATA
    if [ $? -eq 0 ]; then
    success; echo
    else
    failure; echo; return 1
    fi
    
    # Load additional modules (helpers)
    if [ -n "$IPTABLES_MODULES" ]; then
    echo -n $"${IPTABLES}: Loading additional modules: "
    ret=0
    for mod in $IPTABLES_MODULES; do
        echo -n "$mod "
        modprobe $mod > /dev/null 2>&1
        let ret+=$?;
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    touch $VAR_SUBSYS_IPTABLES
    return $ret
}


stop() {
    # Do not stop if iptables module is not loaded.
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0


    flush_n_delete
    set_policy ACCEPT
    
    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
    echo -n $"${IPTABLES}: Unloading modules: "
    ret=0
    for mod in ${NF_MODULES[*]}; do
        rmmod_r $mod
        let ret+=$?;
    done
    # try to unload remaining netfilter modules used by ipv4 and ipv6 
    # netfilter
    for mod in ${NF_MODULES_COMMON[*]}; do
        rmmod_r $mod >/dev/null
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    rm -f $VAR_SUBSYS_IPTABLES
    return $ret
}


save() {
    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0


    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 6


    echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "


    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"


    ret=0
    TMP_FILE=$(/bin/mktemp -q /tmp/$IPTABLES.XXXXXX) \
    && chmod 600 "$TMP_FILE" \
    && $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
    && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
    || ret=1
    if [ $ret -eq 0 ]; then
    if [ -e $IPTABLES_DATA ]; then
        cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
        && chmod 600 $IPTABLES_DATA.save \
        || ret=1
    fi
    if [ $ret -eq 0 ]; then
        cp -f $TMP_FILE $IPTABLES_DATA \
        && chmod 600 $IPTABLES_DATA \
            || ret=1
    fi
    fi
    [ $ret -eq 0 ] && success || failure
    echo
    rm -f $TMP_FILE
    return $ret
}


status() {
    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
    echo $"${IPTABLES}: Firewall is not running."
    return 3
    fi


    # Do not print status if lockfile is missing and iptables modules are not 
    # loaded.
    # Check if iptable modules are loaded
    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
    echo $"${IPTABLES}: Firewall modules are not loaded."
    return 3
    fi


    # Check if firewall is configured (has tables)
    if [ -z "$NF_TABLES" ]; then
    echo $"${IPTABLES}: Firewall is not configured. "
    return 3
    fi


    NUM=
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
    VERBOSE= 
    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
    COUNT=
    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"


    for table in $NF_TABLES; do
    echo $"Table: $table"
    $IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
    done


    return 0
}


restart() {
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
}


case "$1" in
    start)
    [ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
    start
    RETVAL=$?
    ;;
    stop)
    [ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
    stop
    RETVAL=$?
    ;;
    restart|force-reload)
    restart
    RETVAL=$?
    ;;
    condrestart|try-restart)
    [ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
    restart
    RETVAL=$?
    ;;
    status)
    status
    RETVAL=$?
    ;;
    panic)
    flush_n_delete
    set_policy DROP
    RETVAL=$?
        ;;
    save)
    save
    RETVAL=$?
    ;;
    *)
    echo $"Usage: ${IPTABLES} {start|stop|restart|condrestart|status|panic|save}"
    RETVAL=2
    ;;
esac


exit $RETVAL

ls -l /etc/init.d/

Показать
text
[user@localhost ~]$ ls -l /etc/init.d/
итого 260
-rwxr-xr-x. 1 root root  3884 Май 14 19:09 abrt-ccpp
-rwxr-xr-x. 1 root root  1708 Май 14 19:09 abrtd
-rwxr-xr-x. 1 root root  1642 Май 14 19:09 abrt-oops
-rwxr-xr-x. 1 root root  2122 Фев  8 06:38 atd
-rwxr-xr-x. 1 root root  3378 Апр 21 01:30 auditd
-rwxr-xr-x. 1 root root  2540 Май  9 22:54 avahi-daemon
-rwxr-xr-x. 1 root root  5127 Апр  8 11:23 cgconfig
-rwxr-xr-x. 1 root root  3605 Апр  8 11:23 cgred
-rwxr-xr-x. 1 root root 10006 Фев  8 13:59 cpuspeed
-rwxr-xr-x. 1 root root  3017 Апр 12 12:11 cups
-rwxr-xr-x. 1 root root  1430 Фев  8 16:37 dnsmasq
-rwxr-xr-x. 1 root root  3055 Дек  1 12:23 fcoe
-rwxr-xr-x. 1 root root  2809 Май  5 15:50 firstboot
-rw-r--r--. 1 root root 19899 Апр 27 20:17 functions
-rwxr-xr-x. 1 root root  2676 Май  6 18:49 gpm
-rwxr-xr-x. 1 root root  8563 Фев 14 19:07 ip6tables
-rwxr-xr-x. 1 root root  8468 Фев 14 19:07 iptables
-rwxr-xr-x. 1 root root  1624 Фев  9 15:33 irda
-rwxr-xr-x. 1 root root  3745 Апр 30 11:33 iscsi
-rwxr-xr-x. 1 root root  3611 Апр 30 11:33 iscsid
-rwxr-xr-x. 1 root root   659 Апр 27 20:17 killall
-rwxr-xr-x. 1 root root  8617 Май 23 01:49 livesys
-rwxr-xr-x. 1 root root  1734 Май 23 01:48 livesys-late
-rwxr-xr-x. 1 root root  6293 Фев 10 15:12 lldpad
-r-xr-xr-x. 1 root root  2442 Фев  9 16:38 lvm2-monitor
-rwxr-xr-x. 1 root root  2904 Мар 31 19:56 mdmonitor
-rwxr-xr-x. 1 root root  2200 Май  2 19:23 messagebus
-rwxr-xr-x. 1 root root  2363 Фев  8 15:57 multipathd
-rwxr-xr-x. 1 root root  2980 Апр 27 20:17 netconsole
-rwxr-xr-x. 1 root root  5598 Апр 27 20:17 netfs
-rwxr-xr-x. 1 root root  7385 Апр 27 20:17 network
-rwxr-xr-x. 1 root root  2205 Май  9 10:01 NetworkManager
-rwxr-xr-x. 1 root root  1926 Май  6 19:24 ntpd
-rwxr-xr-x. 1 root root  2056 Май  6 19:24 ntpdate
-rwxr-xr-x. 1 root root  6256 Мар 17 15:26 openvpn
-rwxr-xr-x. 1 root root  1834 Фев  9 18:03 portreserve
-rwxr-xr-x. 1 root root  1741 Фев  9 11:44 pppoe-server
-rwxr-xr-x. 1 root root  1560 Фев  9 19:10 psacct
-rwxr-xr-x. 1 root root  1515 Фев  9 17:57 rdisc
-rwxr-xr-x. 1 root root  2659 Май 17 15:15 rfremixconf
-rwxr-xr-x. 1 root root  1979 Май 16 22:44 rsyslog
-rwxr-xr-x. 1 root root  1698 Апр 29 19:17 sandbox
-rwxr-xr-x. 1 root root  2056 Мар 23 17:44 saslauthd
-rwxr-xr-x. 1 root root  3719 Фев  9 15:29 sendmail
-rwxr-xr-x. 1 root root  1300 Янв 11 17:25 smolt
-rwxr-xr-x. 1 root root  4600 Апр 29 10:21 sshd
-rwxr-xr-x. 1 root root  1866 Апр 19 23:03 wpa_supplicant

28.05.2011 00:43 #165588

wers, покажите (используя тэги «spoiler», при необходимости) файлы

  • /etc/init.d/iptables
  • /etc/init.d/ip6tables
28.05.2011 01:06 #165592

ip6tables

Показать
text

#!/bin/sh
#
# ip6tables    Start ip6tables firewall
#
# chkconfig: 2345 08 92
# description:    Starts, stops and saves ip6tables firewall
#
# config: /etc/sysconfig/ip6tables
# config: /etc/sysconfig/ip6tables-config
#
### BEGIN INIT INFO
# Provides: ip6tables
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop ip6tables firewall
# Description: Start, stop and save ip6tables firewall
### END INIT INFO

# Source function library.
. /etc/init.d/functions


IP6TABLES=ip6tables
IP6TABLES_DATA=/etc/sysconfig/$IP6TABLES
IP6TABLES_CONFIG=/etc/sysconfig/${IP6TABLES}-config
IPV=${IP6TABLES%tables} # ip for ipv4 | ip6 for ipv6
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IP6TABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IP6TABLES=/var/lock/subsys/$IP6TABLES


if [ ! -x /sbin/$IP6TABLES ]; then
    echo -n $"${IP6TABLES}: /sbin/$IP6TABLES does not exist."; warning; echo
    exit 5
fi


# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS=1 \
    || NEW_MODUTILS=0


# Default firewall configuration:
IP6TABLES_MODULES=""
IP6TABLES_MODULES_UNLOAD="yes"
IP6TABLES_SAVE_ON_STOP="no"
IP6TABLES_SAVE_ON_RESTART="no"
IP6TABLES_SAVE_COUNTER="no"
IP6TABLES_STATUS_NUMERIC="yes"
IP6TABLES_STATUS_VERBOSE="no"
IP6TABLES_STATUS_LINENUMBERS="yes"


# Load firewall configuration.
[ -f "$IP6TABLES_CONFIG" ] && . "$IP6TABLES_CONFIG"


# Netfilter modules
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6


# Get active tables
NF_TABLES=$(cat "$PROC_IP6TABLES_NAMES" 2>/dev/null)


rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$1
    local ret=0
    local ref=


    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS = 1 ] \
    && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
    || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)


    # recursive call for all referring modules
    for i in $ref; do
    rmmod_r $i
    let ret+=$?;
    done


    # Unload module.
    # The extra test is for 2.6: The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
    modprobe -r $mod > /dev/null 2>&1
    res=$?
    [ $res -eq 0 ] || echo -n " $mod"
    let ret+=$res;
    fi


    return $ret
}


flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0


    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 1


    echo -n $"${IP6TABLES}: Flushing firewall rules: "
    ret=0
    # For all tables
    for i in $NF_TABLES; do
        # Flush firewall rules.
    $IP6TABLES -t $i -F;
    let ret+=$?;


        # Delete firewall chains.
    $IP6TABLES -t $i -X;
    let ret+=$?;


    # Set counter to zero.
    $IP6TABLES -t $i -Z;
    let ret+=$?;
    done


    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}


set_policy() {
    # Set policy for configured tables.
    policy=$1


    # Check if iptable module is loaded
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0


    # Check if firewall is configured (has tables)
    tables=$(cat "$PROC_IP6TABLES_NAMES" 2>/dev/null)
    [ -z "$tables" ] && return 1


    echo -n $"${IP6TABLES}: Setting chains to policy $policy: "
    ret=0
    for i in $tables; do
    echo -n "$i "
    case "$i" in
        raw)
        $IP6TABLES -t raw -P PREROUTING $policy \
            && $IP6TABLES -t raw -P OUTPUT $policy \
            || let ret+=1
        ;;
        filter)
                $IP6TABLES -t filter -P INPUT $policy \
            && $IP6TABLES -t filter -P OUTPUT $policy \
            && $IP6TABLES -t filter -P FORWARD $policy \
            || let ret+=1
        ;;
        nat)
        $IP6TABLES -t nat -P PREROUTING $policy \
            && $IP6TABLES -t nat -P POSTROUTING $policy \
            && $IP6TABLES -t nat -P OUTPUT $policy \
            || let ret+=1
        ;;
        mangle)
            $IP6TABLES -t mangle -P PREROUTING $policy \
            && $IP6TABLES -t mangle -P POSTROUTING $policy \
            && $IP6TABLES -t mangle -P INPUT $policy \
            && $IP6TABLES -t mangle -P OUTPUT $policy \
            && $IP6TABLES -t mangle -P FORWARD $policy \
            || let ret+=1
        ;;
        *)
            let ret+=1
        ;;
        esac
    done


    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}


start() {
    # Do not start if there is no config file.
    [ ! -f "$IP6TABLES_DATA" ] && return 6


    # check if ipv6 module load is deactivated
    if [ "${_IPV}" = "ipv6" ] \
    && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
    echo $"${IP6TABLES}: ${_IPV} is disabled."
    return 150
    fi


    echo -n $"${IP6TABLES}: Applying firewall rules: "


    OPT=
    [ "x$IP6TABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"


    $IP6TABLES-restore $OPT $IP6TABLES_DATA
    if [ $? -eq 0 ]; then
    success; echo
    else
    failure; echo; return 1
    fi
    
    # Load additional modules (helpers)
    if [ -n "$IP6TABLES_MODULES" ]; then
    echo -n $"${IP6TABLES}: Loading additional modules: "
    ret=0
    for mod in $IP6TABLES_MODULES; do
        echo -n "$mod "
        modprobe $mod > /dev/null 2>&1
        let ret+=$?;
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    touch $VAR_SUBSYS_IP6TABLES
    return $ret
}


stop() {
    # Do not stop if ip6tables module is not loaded.
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0


    flush_n_delete
    set_policy ACCEPT
    
    if [ "x$IP6TABLES_MODULES_UNLOAD" = "xyes" ]; then
    echo -n $"${IP6TABLES}: Unloading modules: "
    ret=0
    for mod in ${NF_MODULES[*]}; do
        rmmod_r $mod
        let ret+=$?;
    done
    # try to unload remaining netfilter modules used by ipv4 and ipv6 
    # netfilter
    for mod in ${NF_MODULES_COMMON[*]}; do
        rmmod_r $mod >/dev/null
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    rm -f $VAR_SUBSYS_IP6TABLES
    return $ret
}


save() {
    # Check if iptable module is loaded
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0


    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 6


    echo -n $"${IP6TABLES}: Saving firewall rules to $IP6TABLES_DATA: "


    OPT=
    [ "x$IP6TABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"


    ret=0
    TMP_FILE=$(/bin/mktemp -q /tmp/$IP6TABLES.XXXXXX) \
    && chmod 600 "$TMP_FILE" \
    && $IP6TABLES-save $OPT > $TMP_FILE 2>/dev/null \
    && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
    || ret=1
    if [ $ret -eq 0 ]; then
    if [ -e $IP6TABLES_DATA ]; then
        cp -f $IP6TABLES_DATA $IP6TABLES_DATA.save \
        && chmod 600 $IP6TABLES_DATA.save \
        || ret=1
    fi
    if [ $ret -eq 0 ]; then
        cp -f $TMP_FILE $IP6TABLES_DATA \
        && chmod 600 $IP6TABLES_DATA \
            || ret=1
    fi
    fi
    [ $ret -eq 0 ] && success || failure
    echo
    rm -f $TMP_FILE
    return $ret
}


status() {
    if [ ! -f "$VAR_SUBSYS_IP6TABLES" -a -z "$NF_TABLES" ]; then
    echo $"${IP6TABLES}: Firewall is not running."
    return 3
    fi


    # Do not print status if lockfile is missing and ip6tables modules are not 
    # loaded.
    # Check if iptable modules are loaded
    if [ ! -e "$PROC_IP6TABLES_NAMES" ]; then
    echo $"${IP6TABLES}: Firewall modules are not loaded."
    return 3
    fi


    # Check if firewall is configured (has tables)
    if [ -z "$NF_TABLES" ]; then
    echo $"${IP6TABLES}: Firewall is not configured. "
    return 3
    fi


    NUM=
    [ "x$IP6TABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
    VERBOSE= 
    [ "x$IP6TABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
    COUNT=
    [ "x$IP6TABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"


    for table in $NF_TABLES; do
    echo $"Table: $table"
    $IP6TABLES -t $table --list $NUM $VERBOSE $COUNT && echo
    done


    return 0
}


restart() {
    [ "x$IP6TABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
}


case "$1" in
    start)
    [ -f "$VAR_SUBSYS_IP6TABLES" ] && exit 0
    start
    RETVAL=$?
    ;;
    stop)
    [ "x$IP6TABLES_SAVE_ON_STOP" = "xyes" ] && save
    stop
    RETVAL=$?
    ;;
    restart|force-reload)
    restart
    RETVAL=$?
    ;;
    condrestart|try-restart)
    [ ! -e "$VAR_SUBSYS_IP6TABLES" ] && exit 0
    restart
    RETVAL=$?
    ;;
    status)
    status
    RETVAL=$?
    ;;
    panic)
    flush_n_delete
    set_policy DROP
    RETVAL=$?
        ;;
    save)
    save
    RETVAL=$?
    ;;
    *)
    echo $"Usage: ${IP6TABLES} {start|stop|restart|condrestart|status|panic|save}"
    RETVAL=2
    ;;
esac


exit $RETVAL

/etc/init.d/iptables выше т.е iptables.sh

28.05.2011 09:36 #165622

wers, тогда уж покажите и

  • /etc/sysconfig/iptables
  • /etc/sysconfig/iptables-config
  • /etc/sysconfig/ip6tables
  • /etc/sysconfig/ip6tables-config
28.05.2011 11:23 #165647

iptables

Показать
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 65399 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 65399 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

iptables-config

Показать
# Load additional iptables modules (nat helpers)
# Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES=""

# Unload modules on restart and stop
# Value: yes|no, default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
# Value: yes|no, default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
# Value: yes|no, default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
# Value: yes|no, default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
# Value: yes|no, default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

ip6tables

Показать
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 65399 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 65399 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
COMMIT

ip6tables-config

Показать
# Load additional ip6tables modules (nat helpers)
# Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IP6TABLES_MODULES=""

# Unload modules on restart and stop
# Value: yes|no, default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IP6TABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/ip6tables if firewall gets stopped
# (e.g. on system shutdown).
IP6TABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/ip6tables if firewall gets
# restarted.
IP6TABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
# Value: yes|no, default: no
# Save counters for rules and chains to /etc/sysconfig/ip6tables if
# 'service ip6tables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IP6TABLES_SAVE_COUNTER="no"

# Numeric status output
# Value: yes|no, default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IP6TABLES_STATUS_NUMERIC="yes"

# Verbose status output
# Value: yes|no, default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IP6TABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
# Value: yes|no, default: yes
# Print a counter/number for every rule in the status output.
IP6TABLES_STATUS_LINENUMBERS="yes"

28.05.2011 11:29 #165648

wers, покажите вывод команды
[console]iptables -L -n[/console]
при запущенном firewall и остановленном.

28.05.2011 11:35 #165651

выкл.

Показать
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

вкл.

Показать
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:65399
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:65399
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Войдите или зарегистрируйтесь, чтобы ответить.