NFTABLES 不允许使用 SSH

Question

我有一个规则集在我的服务器看起来像这样:

table inet firewall {
chain INBOUND {
type filter hook input priority filter; policy drop;
ct state established,related accept
ct state invalid drop
iif "lo" counter packets 0 bytes 0 accept
ip protocol icmp limit rate 4/second accept
ip6 nexthdr ipv6-icmp limit rate 4/second accept
ip protocol igmp limit rate 4/second accept
tcp dport 22 accept
log
}
chain FORWARD {
type filter hook forward priority filter; policy drop;
}
chain OUTBOUND {
type filter hook output priority filter; policy drop;
oif "lo" counter packets 35 bytes 1946 accept
tcp dport 22 accept
}
}

我不能从ssh连接端口22，即使应该打开。如果我输入:

$ nft flush ruleset，则22端口允许连接。

我做错了什么?

Answer 1

在我看来，"OUTBOUND"链条是问题所在

您有tcp dport 22 accept，但我认为应该是tcp sport 22 accept，因为当SSH数据包从您的服务器出站时，它们将具有22的源端口，而不是22的目的端口。

Answer 2

将OUTBOUND链更改为:

chain OUTBOUND {
type filter hook output priority filter; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }

# Allow loopback
oif "lo" accept
# Accepted ports out (DNS / DHCP / TIME / WEB for package updates / SMTP)
ct state new udp dport { 53, 67, 123, 547 } accept
ct state new tcp dport { 53, 80, 443, 587 } accept 
log prefix "DROP_output: " limit rate 3/second     
}

• 不接受related出站连接阻止sshd响应。

• 总是在每个默认拒绝链的末尾记录丢弃的数据包。