Linux Forum — Проблема с портами

Re: Проблема с портами

null@example.com (Lupo Alberto) — Sat, 28 May 2011 09:54:21 +0000

wers, по-моему, правильнее изменить переменные в файле
iptables-config

IPTABLES_SAVE_ON_STOP="yes"

IPTABLES_SAVE_ON_RESTART="yes"

Re: Проблема с портами

null@example.com (wers) — Sat, 28 May 2011 09:24:57 +0000

всё решилось банально просто!
команда из под root:

service iptables start

система загружает правила из файла /etc/sysconfig/iptables
при команде:

service iptables stop

система сохраняет текущий набор правил в этот файл и сбрасывает цепочки.

Re: Проблема с портами

null@example.com (wers) — Sat, 28 May 2011 07:35:24 +0000

выкл.

+ открыть спойлер

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

вкл.

+ открыть спойлер

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:65399
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:65399
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Re: Проблема с портами

null@example.com (Lupo Alberto) — Sat, 28 May 2011 07:29:09 +0000

wers, покажите вывод команды

Консоль:

iptables -L -n

при запущенном firewall и остановленном.

Re: Проблема с портами

null@example.com (wers) — Sat, 28 May 2011 07:23:49 +0000

iptables

+ открыть спойлер

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 65399 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 65399 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

iptables-config

+ открыть спойлер

# Load additional iptables modules (nat helpers)
# Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES=""

# Unload modules on restart and stop
# Value: yes|no, default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
# Value: yes|no, default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
# Value: yes|no, default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
# Value: yes|no, default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
# Value: yes|no, default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

ip6tables

+ открыть спойлер

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 65399 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 65399 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
COMMIT

ip6tables-config

+ открыть спойлер

# Load additional ip6tables modules (nat helpers)
# Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IP6TABLES_MODULES=""

# Save current firewall rules on stop.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/ip6tables if firewall gets stopped
# (e.g. on system shutdown).
IP6TABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/ip6tables if firewall gets
# restarted.
IP6TABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
# Value: yes|no, default: no
# Save counters for rules and chains to /etc/sysconfig/ip6tables if
# 'service ip6tables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IP6TABLES_SAVE_COUNTER="no"

# Numeric status output
# Value: yes|no, default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IP6TABLES_STATUS_NUMERIC="yes"

# Verbose status output
# Value: yes|no, default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IP6TABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
# Value: yes|no, default: yes
# Print a counter/number for every rule in the status output.
IP6TABLES_STATUS_LINENUMBERS="yes"

Re: Проблема с портами

null@example.com (Lupo Alberto) — Sat, 28 May 2011 05:36:14 +0000

wers, тогда уж покажите и

/etc/sysconfig/iptables
/etc/sysconfig/iptables-config
/etc/sysconfig/ip6tables
/etc/sysconfig/ip6tables-config

Re: Проблема с портами

null@example.com (wers) — Fri, 27 May 2011 21:06:23 +0000

ip6tables

+ открыть спойлер

#!/bin/sh
#
# ip6tables    Start ip6tables firewall
#
# chkconfig: 2345 08 92
# description:    Starts, stops and saves ip6tables firewall
#
# config: /etc/sysconfig/ip6tables
# config: /etc/sysconfig/ip6tables-config
#
### BEGIN INIT INFO
# Provides: ip6tables
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop ip6tables firewall
# Description: Start, stop and save ip6tables firewall
### END INIT INFO

# Source function library.
. /etc/init.d/functions

IP6TABLES=ip6tables
IP6TABLES_DATA=/etc/sysconfig/$IP6TABLES
IP6TABLES_CONFIG=/etc/sysconfig/${IP6TABLES}-config
IPV=${IP6TABLES%tables} # ip for ipv4 | ip6 for ipv6
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IP6TABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IP6TABLES=/var/lock/subsys/$IP6TABLES

if [ ! -x /sbin/$IP6TABLES ]; then
    echo -n $"${IP6TABLES}: /sbin/$IP6TABLES does not exist."; warning; echo
    exit 5
fi

# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS=1 \
    || NEW_MODUTILS=0

# Default firewall configuration:
IP6TABLES_MODULES=""
IP6TABLES_MODULES_UNLOAD="yes"
IP6TABLES_SAVE_ON_STOP="no"
IP6TABLES_SAVE_ON_RESTART="no"
IP6TABLES_SAVE_COUNTER="no"
IP6TABLES_STATUS_NUMERIC="yes"
IP6TABLES_STATUS_VERBOSE="no"
IP6TABLES_STATUS_LINENUMBERS="yes"

# Load firewall configuration.
[ -f "$IP6TABLES_CONFIG" ] && . "$IP6TABLES_CONFIG"

# Netfilter modules
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6

# Get active tables
NF_TABLES=$(cat "$PROC_IP6TABLES_NAMES" 2>/dev/null)


rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$1
    local ret=0
    local ref=

    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS = 1 ] \
    && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
    || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)

    # recursive call for all referring modules
    for i in $ref; do
    rmmod_r $i
    let ret+=$?;
    done

    # Unload module.
    # The extra test is for 2.6: The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
    modprobe -r $mod > /dev/null 2>&1
    res=$?
    [ $res -eq 0 ] || echo -n " $mod"
    let ret+=$res;
    fi

    return $ret
}

flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0

    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 1

    echo -n $"${IP6TABLES}: Flushing firewall rules: "
    ret=0
    # For all tables
    for i in $NF_TABLES; do
        # Flush firewall rules.
    $IP6TABLES -t $i -F;
    let ret+=$?;

        # Delete firewall chains.
    $IP6TABLES -t $i -X;
    let ret+=$?;

    # Set counter to zero.
    $IP6TABLES -t $i -Z;
    let ret+=$?;
    done

    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}

set_policy() {
    # Set policy for configured tables.
    policy=$1

    # Check if iptable module is loaded
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0

    # Check if firewall is configured (has tables)
    tables=$(cat "$PROC_IP6TABLES_NAMES" 2>/dev/null)
    [ -z "$tables" ] && return 1

    echo -n $"${IP6TABLES}: Setting chains to policy $policy: "
    ret=0
    for i in $tables; do
    echo -n "$i "
    case "$i" in
        raw)
        $IP6TABLES -t raw -P PREROUTING $policy \
            && $IP6TABLES -t raw -P OUTPUT $policy \
            || let ret+=1
        ;;
        filter)
                $IP6TABLES -t filter -P INPUT $policy \
            && $IP6TABLES -t filter -P OUTPUT $policy \
            && $IP6TABLES -t filter -P FORWARD $policy \
            || let ret+=1
        ;;
        nat)
        $IP6TABLES -t nat -P PREROUTING $policy \
            && $IP6TABLES -t nat -P POSTROUTING $policy \
            && $IP6TABLES -t nat -P OUTPUT $policy \
            || let ret+=1
        ;;
        mangle)
            $IP6TABLES -t mangle -P PREROUTING $policy \
            && $IP6TABLES -t mangle -P POSTROUTING $policy \
            && $IP6TABLES -t mangle -P INPUT $policy \
            && $IP6TABLES -t mangle -P OUTPUT $policy \
            && $IP6TABLES -t mangle -P FORWARD $policy \
            || let ret+=1
        ;;
        *)
            let ret+=1
        ;;
        esac
    done

    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}

start() {
    # Do not start if there is no config file.
    [ ! -f "$IP6TABLES_DATA" ] && return 6

    # check if ipv6 module load is deactivated
    if [ "${_IPV}" = "ipv6" ] \
    && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
    echo $"${IP6TABLES}: ${_IPV} is disabled."
    return 150
    fi

    echo -n $"${IP6TABLES}: Applying firewall rules: "

    OPT=
    [ "x$IP6TABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    $IP6TABLES-restore $OPT $IP6TABLES_DATA
    if [ $? -eq 0 ]; then
    success; echo
    else
    failure; echo; return 1
    fi
    
    # Load additional modules (helpers)
    if [ -n "$IP6TABLES_MODULES" ]; then
    echo -n $"${IP6TABLES}: Loading additional modules: "
    ret=0
    for mod in $IP6TABLES_MODULES; do
        echo -n "$mod "
        modprobe $mod > /dev/null 2>&1
        let ret+=$?;
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    touch $VAR_SUBSYS_IP6TABLES
    return $ret
}

stop() {
    # Do not stop if ip6tables module is not loaded.
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0

    flush_n_delete
    set_policy ACCEPT
    
    if [ "x$IP6TABLES_MODULES_UNLOAD" = "xyes" ]; then
    echo -n $"${IP6TABLES}: Unloading modules: "
    ret=0
    for mod in ${NF_MODULES[*]}; do
        rmmod_r $mod
        let ret+=$?;
    done
    # try to unload remaining netfilter modules used by ipv4 and ipv6 
    # netfilter
    for mod in ${NF_MODULES_COMMON[*]}; do
        rmmod_r $mod >/dev/null
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    rm -f $VAR_SUBSYS_IP6TABLES
    return $ret
}

save() {
    # Check if iptable module is loaded
    [ ! -e "$PROC_IP6TABLES_NAMES" ] && return 0

    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 6

    echo -n $"${IP6TABLES}: Saving firewall rules to $IP6TABLES_DATA: "

    OPT=
    [ "x$IP6TABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    ret=0
    TMP_FILE=$(/bin/mktemp -q /tmp/$IP6TABLES.XXXXXX) \
    && chmod 600 "$TMP_FILE" \
    && $IP6TABLES-save $OPT > $TMP_FILE 2>/dev/null \
    && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
    || ret=1
    if [ $ret -eq 0 ]; then
    if [ -e $IP6TABLES_DATA ]; then
        cp -f $IP6TABLES_DATA $IP6TABLES_DATA.save \
        && chmod 600 $IP6TABLES_DATA.save \
        || ret=1
    fi
    if [ $ret -eq 0 ]; then
        cp -f $TMP_FILE $IP6TABLES_DATA \
        && chmod 600 $IP6TABLES_DATA \
            || ret=1
    fi
    fi
    [ $ret -eq 0 ] && success || failure
    echo
    rm -f $TMP_FILE
    return $ret
}

status() {
    if [ ! -f "$VAR_SUBSYS_IP6TABLES" -a -z "$NF_TABLES" ]; then
    echo $"${IP6TABLES}: Firewall is not running."
    return 3
    fi

    # Do not print status if lockfile is missing and ip6tables modules are not 
    # loaded.
    # Check if iptable modules are loaded
    if [ ! -e "$PROC_IP6TABLES_NAMES" ]; then
    echo $"${IP6TABLES}: Firewall modules are not loaded."
    return 3
    fi

    # Check if firewall is configured (has tables)
    if [ -z "$NF_TABLES" ]; then
    echo $"${IP6TABLES}: Firewall is not configured. "
    return 3
    fi

    NUM=
    [ "x$IP6TABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
    VERBOSE= 
    [ "x$IP6TABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
    COUNT=
    [ "x$IP6TABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

    for table in $NF_TABLES; do
    echo $"Table: $table"
    $IP6TABLES -t $table --list $NUM $VERBOSE $COUNT && echo
    done

    return 0
}

restart() {
    [ "x$IP6TABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
}


case "$1" in
    start)
    [ -f "$VAR_SUBSYS_IP6TABLES" ] && exit 0
    start
    RETVAL=$?
    ;;
    stop)
    [ "x$IP6TABLES_SAVE_ON_STOP" = "xyes" ] && save
    stop
    RETVAL=$?
    ;;
    restart|force-reload)
    restart
    RETVAL=$?
    ;;
    condrestart|try-restart)
    [ ! -e "$VAR_SUBSYS_IP6TABLES" ] && exit 0
    restart
    RETVAL=$?
    ;;
    status)
    status
    RETVAL=$?
    ;;
    panic)
    flush_n_delete
    set_policy DROP
    RETVAL=$?
        ;;
    save)
    save
    RETVAL=$?
    ;;
    *)
    echo $"Usage: ${IP6TABLES} {start|stop|restart|condrestart|status|panic|save}"
    RETVAL=2
    ;;
esac

exit $RETVAL

/etc/init.d/iptables выше т.е iptables.sh

Re: Проблема с портами

null@example.com (Lupo Alberto) — Fri, 27 May 2011 20:43:58 +0000

wers, покажите (используя тэги «spoiler», при необходимости) файлы

/etc/init.d/iptables
/etc/init.d/ip6tables

Re: Проблема с портами

null@example.com (wers) — Fri, 27 May 2011 20:37:15 +0000

iptables.sh

+ открыть спойлер

#!/bin/sh
#
# iptables    Start iptables firewall
#
# chkconfig: 2345 08 92
# description:    Starts, stops and saves iptables firewall
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
#
### BEGIN INIT INFO
# Provides: iptables
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: start and stop iptables firewall
# Description: Start, stop and save iptables firewall
### END INIT INFO

# Source function library.
. /etc/init.d/functions

IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES

if [ ! -x /sbin/$IPTABLES ]; then
    echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
    exit 5
fi

# Old or new modutils
/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS=1 \
    || NEW_MODUTILS=0

# Default firewall configuration:
IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"

# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"

# Netfilter modules
NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6

# Get active tables
NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)


rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$1
    local ret=0
    local ref=

    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS = 1 ] \
    && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
    || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)

    # recursive call for all referring modules
    for i in $ref; do
    rmmod_r $i
    let ret+=$?;
    done

    # Unload module.
    # The extra test is for 2.6: The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
    modprobe -r $mod > /dev/null 2>&1
    res=$?
    [ $res -eq 0 ] || echo -n " $mod"
    let ret+=$res;
    fi

    return $ret
}

flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 1

    echo -n $"${IPTABLES}: Flushing firewall rules: "
    ret=0
    # For all tables
    for i in $NF_TABLES; do
        # Flush firewall rules.
    $IPTABLES -t $i -F;
    let ret+=$?;

        # Delete firewall chains.
    $IPTABLES -t $i -X;
    let ret+=$?;

    # Set counter to zero.
    $IPTABLES -t $i -Z;
    let ret+=$?;
    done

    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}

set_policy() {
    # Set policy for configured tables.
    policy=$1

    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

    # Check if firewall is configured (has tables)
    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
    [ -z "$tables" ] && return 1

    echo -n $"${IPTABLES}: Setting chains to policy $policy: "
    ret=0
    for i in $tables; do
    echo -n "$i "
    case "$i" in
        raw)
        $IPTABLES -t raw -P PREROUTING $policy \
            && $IPTABLES -t raw -P OUTPUT $policy \
            || let ret+=1
        ;;
        filter)
                $IPTABLES -t filter -P INPUT $policy \
            && $IPTABLES -t filter -P OUTPUT $policy \
            && $IPTABLES -t filter -P FORWARD $policy \
            || let ret+=1
        ;;
        nat)
        $IPTABLES -t nat -P PREROUTING $policy \
            && $IPTABLES -t nat -P POSTROUTING $policy \
            && $IPTABLES -t nat -P OUTPUT $policy \
            || let ret+=1
        ;;
        mangle)
            $IPTABLES -t mangle -P PREROUTING $policy \
            && $IPTABLES -t mangle -P POSTROUTING $policy \
            && $IPTABLES -t mangle -P INPUT $policy \
            && $IPTABLES -t mangle -P OUTPUT $policy \
            && $IPTABLES -t mangle -P FORWARD $policy \
            || let ret+=1
        ;;
        *)
            let ret+=1
        ;;
        esac
    done

    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
}

start() {
    # Do not start if there is no config file.
    [ ! -f "$IPTABLES_DATA" ] && return 6

    # check if ipv6 module load is deactivated
    if [ "${_IPV}" = "ipv6" ] \
    && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
    echo $"${IPTABLES}: ${_IPV} is disabled."
    return 150
    fi

    echo -n $"${IPTABLES}: Applying firewall rules: "

    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    $IPTABLES-restore $OPT $IPTABLES_DATA
    if [ $? -eq 0 ]; then
    success; echo
    else
    failure; echo; return 1
    fi
    
    # Load additional modules (helpers)
    if [ -n "$IPTABLES_MODULES" ]; then
    echo -n $"${IPTABLES}: Loading additional modules: "
    ret=0
    for mod in $IPTABLES_MODULES; do
        echo -n "$mod "
        modprobe $mod > /dev/null 2>&1
        let ret+=$?;
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    touch $VAR_SUBSYS_IPTABLES
    return $ret
}

stop() {
    # Do not stop if iptables module is not loaded.
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

    flush_n_delete
    set_policy ACCEPT
    
    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
    echo -n $"${IPTABLES}: Unloading modules: "
    ret=0
    for mod in ${NF_MODULES[*]}; do
        rmmod_r $mod
        let ret+=$?;
    done
    # try to unload remaining netfilter modules used by ipv4 and ipv6 
    # netfilter
    for mod in ${NF_MODULES_COMMON[*]}; do
        rmmod_r $mod >/dev/null
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi
    
    rm -f $VAR_SUBSYS_IPTABLES
    return $ret
}

save() {
    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0

    # Check if firewall is configured (has tables)
    [ -z "$NF_TABLES" ] && return 6

    echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "

    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"

    ret=0
    TMP_FILE=$(/bin/mktemp -q /tmp/$IPTABLES.XXXXXX) \
    && chmod 600 "$TMP_FILE" \
    && $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
    && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
    || ret=1
    if [ $ret -eq 0 ]; then
    if [ -e $IPTABLES_DATA ]; then
        cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
        && chmod 600 $IPTABLES_DATA.save \
        || ret=1
    fi
    if [ $ret -eq 0 ]; then
        cp -f $TMP_FILE $IPTABLES_DATA \
        && chmod 600 $IPTABLES_DATA \
            || ret=1
    fi
    fi
    [ $ret -eq 0 ] && success || failure
    echo
    rm -f $TMP_FILE
    return $ret
}

status() {
    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
    echo $"${IPTABLES}: Firewall is not running."
    return 3
    fi

    # Do not print status if lockfile is missing and iptables modules are not 
    # loaded.
    # Check if iptable modules are loaded
    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
    echo $"${IPTABLES}: Firewall modules are not loaded."
    return 3
    fi

    # Check if firewall is configured (has tables)
    if [ -z "$NF_TABLES" ]; then
    echo $"${IPTABLES}: Firewall is not configured. "
    return 3
    fi

    NUM=
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
    VERBOSE= 
    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
    COUNT=
    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

    for table in $NF_TABLES; do
    echo $"Table: $table"
    $IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
    done

    return 0
}

restart() {
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
}


case "$1" in
    start)
    [ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
    start
    RETVAL=$?
    ;;
    stop)
    [ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
    stop
    RETVAL=$?
    ;;
    restart|force-reload)
    restart
    RETVAL=$?
    ;;
    condrestart|try-restart)
    [ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
    restart
    RETVAL=$?
    ;;
    status)
    status
    RETVAL=$?
    ;;
    panic)
    flush_n_delete
    set_policy DROP
    RETVAL=$?
        ;;
    save)
    save
    RETVAL=$?
    ;;
    *)
    echo $"Usage: ${IPTABLES} {start|stop|restart|condrestart|status|panic|save}"
    RETVAL=2
    ;;
esac

exit $RETVAL

ls -l /etc/init.d/

+ открыть спойлер

[user@localhost ~]$ ls -l /etc/init.d/
итого 260
-rwxr-xr-x. 1 root root  3884 Май 14 19:09 abrt-ccpp
-rwxr-xr-x. 1 root root  1708 Май 14 19:09 abrtd
-rwxr-xr-x. 1 root root  1642 Май 14 19:09 abrt-oops
-rwxr-xr-x. 1 root root  2122 Фев  8 06:38 atd
-rwxr-xr-x. 1 root root  3378 Апр 21 01:30 auditd
-rwxr-xr-x. 1 root root  2540 Май  9 22:54 avahi-daemon
-rwxr-xr-x. 1 root root  5127 Апр  8 11:23 cgconfig
-rwxr-xr-x. 1 root root  3605 Апр  8 11:23 cgred
-rwxr-xr-x. 1 root root 10006 Фев  8 13:59 cpuspeed
-rwxr-xr-x. 1 root root  3017 Апр 12 12:11 cups
-rwxr-xr-x. 1 root root  1430 Фев  8 16:37 dnsmasq
-rwxr-xr-x. 1 root root  3055 Дек  1 12:23 fcoe
-rwxr-xr-x. 1 root root  2809 Май  5 15:50 firstboot
-rw-r--r--. 1 root root 19899 Апр 27 20:17 functions
-rwxr-xr-x. 1 root root  2676 Май  6 18:49 gpm
-rwxr-xr-x. 1 root root  8563 Фев 14 19:07 ip6tables
-rwxr-xr-x. 1 root root  8468 Фев 14 19:07 iptables
-rwxr-xr-x. 1 root root  1624 Фев  9 15:33 irda
-rwxr-xr-x. 1 root root  3745 Апр 30 11:33 iscsi
-rwxr-xr-x. 1 root root  3611 Апр 30 11:33 iscsid
-rwxr-xr-x. 1 root root   659 Апр 27 20:17 killall
-rwxr-xr-x. 1 root root  8617 Май 23 01:49 livesys
-rwxr-xr-x. 1 root root  1734 Май 23 01:48 livesys-late
-rwxr-xr-x. 1 root root  6293 Фев 10 15:12 lldpad
-r-xr-xr-x. 1 root root  2442 Фев  9 16:38 lvm2-monitor
-rwxr-xr-x. 1 root root  2904 Мар 31 19:56 mdmonitor
-rwxr-xr-x. 1 root root  2200 Май  2 19:23 messagebus
-rwxr-xr-x. 1 root root  2363 Фев  8 15:57 multipathd
-rwxr-xr-x. 1 root root  2980 Апр 27 20:17 netconsole
-rwxr-xr-x. 1 root root  5598 Апр 27 20:17 netfs
-rwxr-xr-x. 1 root root  7385 Апр 27 20:17 network
-rwxr-xr-x. 1 root root  2205 Май  9 10:01 NetworkManager
-rwxr-xr-x. 1 root root  1926 Май  6 19:24 ntpd
-rwxr-xr-x. 1 root root  2056 Май  6 19:24 ntpdate
-rwxr-xr-x. 1 root root  6256 Мар 17 15:26 openvpn
-rwxr-xr-x. 1 root root  1834 Фев  9 18:03 portreserve
-rwxr-xr-x. 1 root root  1741 Фев  9 11:44 pppoe-server
-rwxr-xr-x. 1 root root  1560 Фев  9 19:10 psacct
-rwxr-xr-x. 1 root root  1515 Фев  9 17:57 rdisc
-rwxr-xr-x. 1 root root  2659 Май 17 15:15 rfremixconf
-rwxr-xr-x. 1 root root  1979 Май 16 22:44 rsyslog
-rwxr-xr-x. 1 root root  1698 Апр 29 19:17 sandbox
-rwxr-xr-x. 1 root root  2056 Мар 23 17:44 saslauthd
-rwxr-xr-x. 1 root root  3719 Фев  9 15:29 sendmail
-rwxr-xr-x. 1 root root  1300 Янв 11 17:25 smolt
-rwxr-xr-x. 1 root root  4600 Апр 29 10:21 sshd
-rwxr-xr-x. 1 root root  1866 Апр 19 23:03 wpa_supplicant

Re: Проблема с портами

null@example.com (Lupo Alberto) — Fri, 27 May 2011 20:12:47 +0000

wers, не могли бы вы показать полностью скрипт, запускающий firewall?

Re: Проблема с портами

null@example.com (wers) — Fri, 27 May 2011 19:50:13 +0000

машина не сервер. домашний комп. просто торрент клиент пишет что порт закрыт, нет раздачи ни на локальном треккере ни на внешних треккерах. забыл сказать, фаервол отключаю порт открывается.

Re: Проблема с портами

null@example.com (Lupo Alberto) — Fri, 27 May 2011 19:45:54 +0000

wers пишет:

и на внешке и на локалке закрыт.

Что-то я несколько запутался... Что значит «и на внешке и на локалке закрыт»?
Опишите, на какой машине поднят сервер, откуда пытаетесь подключиться клиентом? Или вы подключаетесь через веб-интерфейс?

Re: Проблема с портами

null@example.com (wers) — Fri, 27 May 2011 19:35:04 +0000

подключён по кабелю. и на внешке и на локалке закрыт. утром слез с Ubuntu, всё было нормально

Re: Проблема с портами

null@example.com (Lupo Alberto) — Fri, 27 May 2011 19:30:59 +0000

wers пишет:

transmission и треккер показывают что порт закрыт. модемов и роутеров нет. в чём может быть проблема?

А какое у вас подключение? Треккер внешний либо в локальной сети?

Re: Проблема с портами

null@example.com (wers) — Fri, 27 May 2011 19:27:08 +0000

вот;

[user@localhost ~]$ lsof -i :65399
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
transmiss 1918 user   13u  IPv4  23900      0t0  TCP *:65399 (LISTEN)
transmiss 1918 user   14r  IPv6  23902      0t0  TCP *:65399 (LISTEN)
transmiss 1918 user   15w  IPv4  23903      0t0  UDP *:65399 
[user@localhost ~]$ grep 'peer-port' ~/.config/transmission/settings.json
    "peer-port": 65399, 
    "peer-port-random-high": 65535, 
    "peer-port-random-low": 49152, 
    "peer-port-random-on-start": false,