Ôëåøêà, ssh äîñòóï èç wan, ïðîáðîñ è îòêðûòèå ïîðòîâ èç web èíòåðôåéñà

[Longmen]

ïðîáðîñ ïîðòîâ íà ÏÊ çà ðîóòåðîì --- ðàçäåë Âèðòóàëüíûé ñåðâåð â âåáìîðäå. Ïðîáðîñ ïîðòîâ íà ðîóòåð --- òîëüêî ÷åðåç post-firewall.

Çàáûë óòî÷íèòü. Ëîêàëüíî âñå íîðìàëüíî, íè÷åãî íå òîðìîçèò. Óäàëåííî (äîìîâàÿ ñåòü 100 ìåãàáèò) áûâàþò ÷àñòûå òîðìîçà.

Ñåé÷àñ ïðîâåðèë ÷åðåç firefox - òîæå òîðìîçèò

[al37919]

À òàê èñòðóêöèÿ ïîïðîáðîñó, äàííàÿ âûøå, âåðíà?

ñêàæåì òàê --- ðàáîòàòü äîëæíî

[al37919]

Çàáûë óòî÷íèòü. Ëîêàëüíî âñå íîðìàëüíî, íè÷åãî íå òîðìîçèò. Óäàëåííî (äîìîâàÿ ñåòü 100 ìåãàáèò) áûâàþò ÷àñòûå òîðìîçà.

Ñåé÷àñ ïðîâåðèë ÷åðåç firefox - òîæå òîðìîçèò

êàêîé óæàñ --- âû ýòó âåáìîðäó îòêðûâàåòå íàðóæó? Ëó÷øå ýòîãî âîîáùå íå äåëàòü.

[Longmen]

êàêîé óæàñ --- âû ýòó âåáìîðäó îòêðûâàåòå íàðóæó? Ëó÷øå ýòîãî âîîáùå íå äåëàòü.

Ìîæíî ñêàçàòü ÷òî íàðóæó, íî âîïðîñ íå â òîì ÷òî ýòîãî ëó÷üøå íå äåëàòü, à â òîì ïî÷åìó òîðìîçèò.
ß óæå âèäåë îäíó æàëîáó íà ýòî, ïðåäëàãàëè îòêàòèòüñÿ íà áîëåå ðàííþþ âåðñèþ.
Ïðîñòî íà ddwrt è íà ñòàíäàðòíîé ïðîøèâêå òîðìîçîâ íåáûëî ñ òàêèìè æå óñëîâèÿìè.

[Longmen]

Â÷åðà ïîïðîáîâàë ñäåëàòü äîñòóï èç âíåøêè. Íåïîëó÷èëîñü.
Âîò ÷òî ÿ äåëàë:
1)ñîçäàë ïàïêó bin êîìàíäîé mkdir bin â äèðåêòîðèè /usr/local/, òàê êàê òàì å¸ íåáûëî.
2)ñîçäàë ôàéë post-firewall â ïàïêå /usr/local/bin/ êîìàíäîé vi post-firewall
2.1)ïðîïèñàë 4 ñòðîêè

#!/bin/sh
iptables -I INPUT -p tcp --dport 21 -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 23 -j ACCEPT

2.2)ñîõðàíèë êîìàíäîé :wq Ôàéë ïîòîì îòêðûâàë ðåäàêòîðîì, âñå ñòðîêè íà ìåñòå.
3)ñäåëàë åãî èñïîëíÿåìûì êîìàíäîé chmod +x post-firewall, îí ñòàë çåëåíûì â ñïèñêå ôàéëîâ.
4)Âûïîëíèë êîìàíäó flashfs save && flashfs commit && flashfs enable, ïîñëå íåé ÷òî òî ìíîãî ÷åãî íà ïèñàëîñü.
5)Ïåðåçàãóðçèë ðîóòåð.

×òî ÿ ñäåëàë íå òàê èëè íå òàì?

[al37919]

/usr/local/sbin/post-firewall

[Longmen]

/usr/local/sbin/post-firewall

Íå âûøëî. ×òî äåëàë:
1)ñîçäàë ïàïêó sbin êîìàíäîé mkdir â /usr/local
2)ïåðåìåñòèë êîìàíäîé mv ôàéë post-firewall èç /usr/local/bin/post-firewall â /usr/local/sbin/post-firewall
3)ñäåëàë åãî èñïîëíÿåìûì chmod +x /usr/local/sbin/post-firewall
4)âûïîëíèë êîìàíäó flashfs save && flashfs commit && flashfs enable
5)ïåðåçàãðóçèëñÿ.

Äåëëà ýòî èç web èíòåðôåéñà ðîóòåðà, îêàçûâàåòñÿ òàì åñòü êîìàíäíàÿ ñòðîêà.

Ïîõîæå ïóòè íåâåðíûå.
Âîò ÷òî ó ìåíÿ â äèðåêòîðèè /usr

drwxr-xr-x 2 admin root 20 Sep 30 20:45 X11R6
drwxr-xr-x 2 admin root 544 Sep 30 20:44 bin
drwxr-xr-x 2 admin root 160 Sep 30 20:44 codepages
drwxr-xr-x 4 admin root 149 Sep 30 20:45 etc
drwxr-xr-x 5 admin root 184 Sep 30 20:45 lib
lrwxrwxrwx 1 admin root 12 Sep 30 20:45 local -> ../tmp/local
drwxr-xr-x 4 admin root 68 Sep 30 20:36 ppp
drwxr-xr-x 2 admin root 867 Sep 30 20:44 sbin
drwxr-xr-x 5 admin root 62 Sep 30 20:40 share
lrwxrwxrwx 1 admin root 6 Sep 30 20:45 tmp -> ../tmp

Ìîæåò áûòü íóæíî /usr/sbin/post-firewall
èëè /usr/bin/post-firewall

 íèõ íå êîïèðóåòñÿ, îáå ýòè äèðåêòîðèè òîëüêî äëÿ ÷òåíèÿ

[al37919]

ïóòü âåðíûé. /usr/local --- ñèìëèíê íà /tmp/local, êîòîðûé æèâåò â ramfs

äîñòóï èç WAN ê âñòðîåííûì ssh è ftp ñåðâåðàì ìîæíî îòêðûòü ÷åðåç âåá èíòåðôåéñ. À ê òåëíåòó è âåìáîðäå ëó÷øå íå îòêðûâàòü âîîáùå.

[Longmen]

ïóòü âåðíûé. /usr/local --- ñèìëèíê íà /tmp/local, êîòîðûé æèâåò â ramfs

äîñòóï èç WAN ê âñòðîåííûì ssh è ftp ñåðâåðàì ìîæíî îòêðûòü ÷åðåç âåá èíòåðôåéñ. À ê òåëíåòó è âåìáîðäå ëó÷øå íå îòêðûâàòü âîîáùå.

×åðåç âåá èíòåðôåéñ äîñòóïîòêðûò ê ssh ftp è telnet, íî íåçóëüòàòà íåò.
Íåçíàþ â ÷åì ïðîáëåìà.
Ìîæåò ìîæíî êàê òî ïðîäèàãíîñòèðîâàòü?

[al37919]

×åðåç âåá èíòåðôåéñ äîñòóïîòêðûò ê ssh ftp è telnet, íî íåçóëüòàòà íåò.

òîãäà è post-firewall íå ïîìîæåò

Ïîêàæèòå âûâîä iptables-save, à òàêæå ps

[Longmen]

Ïîêàæèòå âûâîä iptables-save, à òàêæå ps

# Generated by iptables-save v1.3.8 on Fri Dec 10 11:15:08 2010
*nat
:PREROUTING ACCEPT [3614:234926]
:POSTROUTING ACCEPT [53:5564]
:OUTPUT ACCEPT [25:4238]
:VSERVER - [0:0]
-A PREROUTING -d 10.128.0.58 -j VSERVER 
-A PREROUTING -d 10.15.15.1 -j VSERVER 
-A POSTROUTING -s ! 10.128.0.58 -o ppp0 -j MASQUERADE 
-A POSTROUTING -s ! 10.15.15.1 -o vlan1 -j MASQUERADE 
-A POSTROUTING -s 192.168.1.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -o br0 -j MASQUERADE 
-A VSERVER -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.1.1:80 
-A VSERVER -p udp -m udp --dport 51489 -j DNAT --to-destination 192.168.1.4:51489 
-A VSERVER -p udp -m udp --dport 60285 -j DNAT --to-destination 192.168.1.136:60285 
-A VSERVER -p udp -m udp --dport 54640 -j DNAT --to-destination 192.168.1.136:54640 
-A VSERVER -p tcp -m tcp --dport 1833 -j DNAT --to-destination 192.168.1.136:1833 
-A VSERVER -p udp -m udp --dport 1833 -j DNAT --to-destination 192.168.1.136:1833 
-A VSERVER -p tcp -m tcp --dport 35322 -j DNAT --to-destination 192.168.1.136:35322 
-A VSERVER -p tcp -m tcp --dport 5900 -j DNAT --to-destination 192.168.1.136:5900 
-A VSERVER -p udp -m udp --dport 5900 -j DNAT --to-destination 192.168.1.136:5900 
-A VSERVER -p tcp -m tcp --dport 3400 -j DNAT --to-destination 192.168.1.136:3400 
-A VSERVER -j DNAT --to-destination 192.168.1.136 
-A VSERVER -p udp -m udp --dport 55527 -j DNAT --to-destination 192.168.1.136:55527 
COMMIT
# Completed on Fri Dec 10 11:15:08 2010
# Generated by iptables-save v1.3.8 on Fri Dec 10 11:15:08 2010
*mangle
:PREROUTING ACCEPT [19136:2524034]
:INPUT ACCEPT [3953:597119]
:FORWARD ACCEPT [15006:1907089]
:OUTPUT ACCEPT [11104:2196370]
:POSTROUTING ACCEPT [26275:4159580]
COMMIT
# Completed on Fri Dec 10 11:15:08 2010
# Generated by iptables-save v1.3.8 on Fri Dec 10 11:15:08 2010
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [7321:421210]
:OUTPUT ACCEPT [11032:2182459]
:BRUTE - [0:0]
:MACS - [0:0]
:SECURITY - [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT 
-A INPUT -m state --state INVALID -j DROP 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i lo -m state --state NEW -j ACCEPT 
-A INPUT -i br0 -m state --state NEW -j ACCEPT 
-A INPUT -d 224.0.0.0/240.0.0.0 -p igmp -j ACCEPT 
-A INPUT -d 224.0.0.0/240.0.0.0 -p udp -m udp ! --dport 1900 -j ACCEPT 
-A INPUT -i ppp0 -m state --state NEW -j SECURITY 
-A INPUT -i vlan1 -m state --state NEW -j SECURITY 
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A INPUT -d 192.168.1.1 -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -p udp -m udp --dport 33434:33534 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 515 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 9100 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 3838 -j ACCEPT 
-A INPUT -j DROP 
-A FORWARD -d 192.168.1.136 -p udp -m udp --dport 55527 -j ACCEPT 
-A FORWARD -i br0 -o br0 -j ACCEPT 
-A FORWARD -m state --state INVALID -j DROP 
-A FORWARD -d 224.0.0.0/240.0.0.0 -p udp -j ACCEPT 
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i ! br0 -o ppp0 -j DROP 
-A FORWARD -i ! br0 -o vlan1 -j DROP 
-A FORWARD -i ! br0 -m state --state NEW -j SECURITY 
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT 
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN 
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN 
-A SECURITY -p udp -m limit --limit 5/sec -j RETURN 
-A SECURITY -p icmp -m limit --limit 5/sec -j RETURN 
-A SECURITY -j DROP 
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options 
-A logaccept -j ACCEPT 
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options 
-A logdrop -j DROP 
COMMIT
# Completed on Fri Dec 10 11:15:08 2010 

PID USER       VSZ STAT COMMAND
    1 admin     1480 S    /sbin/init
    2 admin        0 SW   [keventd]
    3 admin        0 SWN  [ksoftirqd_CPU0]
    4 admin        0 SW   [kswapd]
    5 admin        0 SW   [bdflush]
    6 admin        0 SW   [kupdated]
    7 admin        0 SW   [mtdblockd]
   61 admin     1476 S    syslogd -m 0 -O /tmp/syslog.log -S -D -l 7 -b 1
   65 admin     1472 S    klogd
   66 admin     1472 S    telnetd
   69 admin     1088 S    dropbear -4
   72 admin     1112 S    httpd vlan1
   77 admin     1080 S    nas /tmp/nas.lan.conf /tmp/nas.lan.pid lan
   82 nobody     848 S    dnsmasq
   84 admin      968 S    lld2d br0 eth1
   85 admin        0 SW   [khubd]
  103 admin      692 S    /usr/sbin/igmpproxy /etc/igmpproxy.conf
  105 admin     1304 S    pppd file /tmp/ppp/options.wan0
  107 admin     1488 S    watchdog
  111 admin     1304 S    pppd file /tmp/ppp/options.wan0
  112 admin        0 SW   [usb-storage-0]
  113 admin        0 SW   [scsi_eh_0]
  133 admin     1080 S    upnp -D -L br0 -W ppp0
  140 admin        0 SW   [kjournald]
  143 admin      940 S    /usr/sbin/vsftpd
  150 admin     1476 S    /bin/sh -c ps
  151 admin     1476 R    ps 

[al37919]

ýòî óñïåøíî äîáàâëåíî ÷åðåç post-firewall:

-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT 

ýòî óñïåøíî ïðîáðîøåíî ÷åðåç âåá-ìîðäó:

-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT 
-A INPUT -d 192.168.1.1 -p tcp -m tcp --dport 80 -j ACCEPT 

äåìîíû çàïóùåíû, ò.å. âñå ôóíêöèîíèðóåò. Ïðîáëåìó ñëåäóåò èñêàòü íå â ðîóòåðå à â îêðóæåíèè. Âîçìîæíî, ïðîâàéäåð áëîêèðóåò ïîðòû.

[vectorm]

-A POSTROUTING -s ! 10.128.0.58 -o ppp0 -j MASQUERADE 

Ñóäÿ ïî ýòîìó - ó Âàñ "ñåðûé" IP íà âíåøíåì èíòåðôåéñå - åñëè ó ïðîâàéäåðà íå èñïîëüçóåòñÿ ïðÿìîé NAT, òî äîñòóï ñíàðóæè - òîëüêî çàêàçîì "áåëîãî" IP àäðåñà.