linux - 使用 iptables 保护 mongodb 端口

Question

这是我的 iptables 配置:

sudo iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
  859  103K ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    5   260 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:ssh
    3   230 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:27017
    4   208 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:28017
    0     0 ACCEPT     all  --  any    any     localhost            anywhere            
    0     0 ACCEPT     all  --  any    any     111.111.111.111      anywhere            
    0     0 ACCEPT     all  --  any    any     222.222.222.222      anywhere            
   64  3844 DROP       all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 764 packets, 227K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     localhost            anywhere            
    0     0 ACCEPT     all  --  any    any     111.111.111.111      anywhere            
    0     0 ACCEPT     all  --  any    any     222.222.222.222      anywhere

如果我在浏览器中写入 ip(如果我的 mongodb 服务器的端口为 28017)，我会看到提示输入用户名和密码:

#ip mongodb server
000.000.000.000:28017

我想关闭 mongodb 端口给除这两个 ips 之外的任何人:

111.111.111.111
222.222.222.222

我该怎么做？

Answer 1

你能试试下面的iptables规则吗

-A INPUT -m state --state NEW -p tcp --destination-port 27017 -s 111.111.111.111 -j ACCEPT
-A INPUT -m state --state NEW -p tcp --destination-port 27017 -s 222.222.222.222 -j ACCEPT

看起来你忘了输入源 IP 标志。