对接者是如何绕过我的隐形眼镜的？

Question

我的目标是阻止所有端口从非"lo“接口，除了22，80,443。我不希望我的Rasberry pi的外部设备能够访问除22，80,443以外的任何其他设备。

我在9123端口上运行了一个nc服务器。我的nftable正确地阻止LAN设备访问该端口。但是--我从码头开始的任何服务似乎都没有被阻止--其他局域网设备可以访问PI上的对接服务器。我不太明白这是怎么回事。在第107行上，我的错误策略是删除，过程行在"lo“接口上添加了一个异常。这到底是怎么回事？以及如何才能达到预期的行为(即)为了阻止LAN设备访问pi上的任何东西，除了22,80,443？谢谢

   root@raspberrypi:/home/pi/tmp # nft  list ruleset   | awk '{printf "%d\t%s\n", NR, $0}'
    1   table ip nat {
    2       chain DOCKER {
    3           iifname "docker0" counter packets 0 bytes 0 return
    4           iifname "docker_gwbridge" counter packets 0 bytes 0 return
    5           iifname "br-7a4b6e0a5c6f" counter packets 3840 bytes 115200 return
    6           iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 8920 counter packets 0 bytes 0 dnat to 172.20.0.2:8920
    7           iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 8096 counter packets 0 bytes 0 dnat to 172.20.0.2:8096
    8           iifname != "docker0" meta l4proto tcp tcp dport 8080 counter packets 0 bytes 0 dnat to 172.17.0.2:8080
    9           iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 445 counter packets 0 bytes 0 dnat to 172.20.0.3:445
    10          iifname != "docker0" meta l4proto tcp tcp dport 3389 counter packets 0 bytes 0 dnat to 172.17.0.2:3389
    11          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 9125 counter packets 8306 bytes 531572 dnat to 172.20.0.5:80
    12          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 9123 counter packets 0 bytes 0 dnat to 172.20.0.6:80
    13          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 139 counter packets 0 bytes 0 dnat to 172.20.0.3:139
    14          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 9124 counter packets 0 bytes 0 dnat to 172.20.0.7:80
    15          iifname != "br-7a4b6e0a5c6f" meta l4proto tcp tcp dport 32400 counter packets 0 bytes 0 dnat to 172.20.0.8:32400
    16      }
    17  
    18      chain POSTROUTING {
    19          type nat hook postrouting priority srcnat; policy accept;
    20          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 958 bytes 399977 masquerade
    21          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    22          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 184 bytes 12810 masquerade
    23          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    24          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 8 bytes 502 masquerade
    25          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    26          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    27          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    28          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 8 bytes 502 masquerade
    29          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 45 bytes 3148 masquerade
    30          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    31          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 36 bytes 2324 masquerade
    32          oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
    33          oifname != "br-7a4b6e0a5c6f" ip saddr 172.20.0.0/16 counter packets 36 bytes 2324 masquerade
    34          oifname != "docker_gwbridge" ip saddr 172.19.0.0/16 counter packets 0 bytes 0 masquerade
    35          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    36          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8920 counter packets 0 bytes 0 masquerade
    37          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    38          ip saddr 172.20.0.4 ip daddr 172.20.0.4 tcp dport 32400 counter packets 0 bytes 0 masquerade
    39          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8096 counter packets 0 bytes 0 masquerade
    40          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 80 counter packets 0 bytes 0 masquerade
    41          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 445 counter packets 0 bytes 0 masquerade
    42          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 80 counter packets 0 bytes 0 masquerade
    43          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 80 counter packets 0 bytes 0 masquerade
    44          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 139 counter packets 0 bytes 0 masquerade
    45          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
    46          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    47          ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 32400 counter packets 0 bytes 0 masquerade
    48          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    49          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 80 counter packets 0 bytes 0 masquerade
    50          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 80 counter packets 0 bytes 0 masquerade
    51          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 445 counter packets 0 bytes 0 masquerade
    52          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 8920 counter packets 0 bytes 0 masquerade
    53          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 139 counter packets 0 bytes 0 masquerade
    54          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 8096 counter packets 0 bytes 0 masquerade
    55          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 445 counter packets 0 bytes 0 masquerade
    56          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    57          ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 80 counter packets 0 bytes 0 masquerade
    58          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    59          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 139 counter packets 0 bytes 0 masquerade
    60          ip saddr 172.20.0.4 ip daddr 172.20.0.4 tcp dport 32400 counter packets 0 bytes 0 masquerade
    61          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 80 counter packets 0 bytes 0 masquerade
    62          ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 80 counter packets 0 bytes 0 masquerade
    63          ip saddr 172.20.0.9 ip daddr 172.20.0.9 tcp dport 8920 counter packets 0 bytes 0 masquerade
    64          ip saddr 172.20.0.9 ip daddr 172.20.0.9 tcp dport 8096 counter packets 0 bytes 0 masquerade
    65          ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
    66          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    67          ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    68          ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 80 counter packets 0 bytes 0 masquerade
    69          ip saddr 172.20.0.4 ip daddr 172.20.0.4 tcp dport 80 counter packets 0 bytes 0 masquerade
    70          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 8920 counter packets 0 bytes 0 masquerade
    71          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 445 counter packets 0 bytes 0 masquerade
    72          ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 32400 counter packets 0 bytes 0 masquerade
    73          ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 8096 counter packets 0 bytes 0 masquerade
    74          ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 139 counter packets 0 bytes 0 masquerade
    75          meta l4proto tcp ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8920 counter packets 0 bytes 0 masquerade
    76          meta l4proto tcp ip saddr 172.20.0.2 ip daddr 172.20.0.2 tcp dport 8096 counter packets 0 bytes 0 masquerade
    77          meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 8080 counter packets 0 bytes 0 masquerade
    78          meta l4proto tcp ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 445 counter packets 0 bytes 0 masquerade
    79          meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 3389 counter packets 0 bytes 0 masquerade
    80          meta l4proto tcp ip saddr 172.20.0.5 ip daddr 172.20.0.5 tcp dport 80 counter packets 0 bytes 0 masquerade
    81          meta l4proto tcp ip saddr 172.20.0.6 ip daddr 172.20.0.6 tcp dport 80 counter packets 0 bytes 0 masquerade
    82          meta l4proto tcp ip saddr 172.20.0.3 ip daddr 172.20.0.3 tcp dport 139 counter packets 0 bytes 0 masquerade
    83          meta l4proto tcp ip saddr 172.20.0.7 ip daddr 172.20.0.7 tcp dport 80 counter packets 0 bytes 0 masquerade
    84          meta l4proto tcp ip saddr 172.20.0.8 ip daddr 172.20.0.8 tcp dport 32400 counter packets 0 bytes 0 masquerade
    85      }
    86  
    87      chain PREROUTING {
    88          type nat hook prerouting priority dstnat; policy accept;
    89          fib daddr type local counter packets 86612 bytes 5842738 jump DOCKER
    90          fib daddr type local counter packets 59086 bytes 4082250 jump DOCKER
    91          fib daddr type local counter packets 58016 bytes 4020180 jump DOCKER
    92          fib daddr type local counter packets 58010 bytes 4019512 jump DOCKER
    93          fib daddr type local counter packets 21891 bytes 1551454 jump DOCKER
    94      }
    95  
    96      chain OUTPUT {
    97          type nat hook output priority -100; policy accept;
    98          ip daddr != 127.0.0.0/8 fib daddr type local counter packets 11 bytes 660 jump DOCKER
    99          ip daddr != 127.0.0.0/8 fib daddr type local counter packets 10 bytes 600 jump DOCKER
    100         ip daddr != 127.0.0.0/8 fib daddr type local counter packets 9 bytes 540 jump DOCKER
    101         ip daddr != 127.0.0.0/8 fib daddr type local counter packets 8 bytes 480 jump DOCKER
    102         ip daddr != 127.0.0.0/8 fib daddr type local counter packets 1 bytes 60 jump DOCKER
    103     }
    104 }
    105 table ip filter {
    106     chain INPUT {
    107         type filter hook input priority -450; policy drop;
    108         iifname "lo" counter packets 19231 bytes 156043045 accept
    109         ip daddr 127.0.0.0/8 counter packets 0 bytes 0 reject
    110         ct state established,related counter packets 67781 bytes 452733513 accept
    111         icmp type echo-request accept
    112         ct state new tcp dport 22 counter packets 119 bytes 7020 accept
    113         ct state new tcp dport 443 counter packets 324 bytes 19343 accept
    114         ct state new tcp dport 80 counter packets 17 bytes 916 accept
    115         ip protocol icmp counter packets 0 bytes 0 accept
    116         limit rate 5/minute counter packets 685 bytes 107167 log prefix "iptables denied: " level debug
    117         tcp dport 9125 drop
    118         counter packets 27066 bytes 4826608 drop
    119     }
    120 
    121     chain OUTPUT {
    122         type filter hook output priority filter - 1; policy drop;
    123         counter packets 133164 bytes 583633753 accept
    124     }
    125 }

Answer 1

如下面的Netfilter和通用网络中的分组流原理图所示：

nat预路由链发生在路由决定之前。因此，当Docker使用DNAT将目标从初始网络命名空间(即主机)更改为另一个网络名称空间(路由容器)时，流不再通过过滤器/输入，而是使用filter/forward: ip过滤器输入链不再遍历。选择优先级-450并不会改变任何事情:这是同一个钩子内的优先级。预释放总是在输入之前发生(如原理图所示)，不管选择的优先级是什么。在过滤器/输入中使用-450只允许先遍历链，然后再遍历iptables的默认优先级0。

另外，作为注释，选择带有nftable的链式ip filter INPUT (因为优先级-450只能使用nftable)可能会与iptables-nft的S过滤器/输入链的处理发生冲突，应该避免。

输入规则仍然可以在几种情况下使用：

• 当与码头无关时:码头不为其集装箱重定向运输
• 当容器停止时(例如:应用程序崩溃并没有自动重新启动)，Docker将删除相关规则:数据包不再被路由/转发。
• 当容器是另一个容器的客户端时，可能取决于Docker的配置(关于docker-proxy和由Docker的userland-proxy全局参数控制的NAT发夹)，然后在docker-proxy情况下，流量不会被路由(因为它通过作为代理的docker-proxy )，从而到达输入钩子。

我还在use /A中回答了如何沿Docker使用nftable，以及如何使用iptables和br内核模块，这也影响nftable，即使nftable没有足够的工具来处理它：

nftables白名单码头