番茄DMZ服务器上某些服务外网无法访问是怎么回事？ - 未名空间MITBBS历史存档

国际科技财经博客移民网络热点娱乐民生时事公众号

Redian新闻

>未名空间

>EmergingNetworking - 热门网络技术

番茄DMZ服务器上某些服务外网无法访问是怎么回事？

番茄DMZ服务器上某些服务外网无法访问是怎么回事？# EmergingNetworking - 热门网络技术

k*12013-12-18 08:12

1 楼

School of Information Systems, Singapore Management University
Project on software security: three research engineers and one postdoc
The research engineers and postdoc will join a research project on software
security. They will assist in designing, developing and evaluating research
prototypes. Candidates should have strong programming background in C/C++ or
Ocaml. Those who have experiences in security research and operating
systems programming are preferred. A research engineer needs to have

y*i2013-12-18 08:12

2 楼

虽说pending期间是合法的，但万一出状况岂不是要立刻走人？

P*e2013-12-18 08:12

3 楼

HD里买不到硫酸铜，就连石灰都没有

d*e2013-12-18 08:12

4 楼

真TMD想不开

t*m2013-12-18 08:12

5 楼

番茄内网上有一台服务器是DMZ模式。SSL(443)，SMTP(25)，SIP/Asterisk(5060)等外
网访问正常。但是另外一些服务器使用不规则端口的从外网无法访问。用端口扫描发现
这些服务本身所在的端口都接收到外网的请求，但是随后而来的随机端口(RTP?)
request无法响应。
因为已经处于DMZ模式了，所以不知道是不是firmware的防火墙或IPtable设置出了问题
。其实我基本上用的缺省设置。另外同一个路由器(ASUS RT-N12)刷DD-WRT也有同样问
题。
使用AT&T Uverse的猫加路由就没有这个问题，所有服务从外网访问正常。所以不是ISP
封杀端口的问题。
难道会是路由器的问题？

k*12013-12-18 08:12

6 楼

招聘进行中，顶顶

f*n2013-12-18 08:12

7 楼

再变成H4回来不就行了。

s*g2013-12-18 08:12

8 楼

He was in the midst of an argument with his wife about how to take care of t
heir recently-born preemie twins when he jumped from his 16th floor balcony
in Washington Square Village, where many NYU professors live.

【在 d******e 的大作中提到】

: 真TMD想不开

s*g2013-12-18 08:12

9 楼

Can your firewall appliance recognize (meaning stateful inspection) your
application so that it can dynamically open up RTP/UDP ports negotiated in
control channel? By default most distributions have Iptable allowing
everything, A simple tcpdump on server will almost immediately tell you
where the problem is, a simple flow debug on firewall will do the job also.

ISP

【在 t*m 的大作中提到】

: 番茄内网上有一台服务器是DMZ模式。SSL(443)，SMTP(25)，SIP/Asterisk(5060)等外
: 网访问正常。但是另外一些服务器使用不规则端口的从外网无法访问。用端口扫描发现
: 这些服务本身所在的端口都接收到外网的请求，但是随后而来的随机端口(RTP?)
: request无法响应。
: 因为已经处于DMZ模式了，所以不知道是不是firmware的防火墙或IPtable设置出了问题
: 。其实我基本上用的缺省设置。另外同一个路由器(ASUS RT-N12)刷DD-WRT也有同样问
: 题。
: 使用AT&T Uverse的猫加路由就没有这个问题，所有服务从外网访问正常。所以不是ISP
: 封杀端口的问题。
: 难道会是路由器的问题？

b*e2013-12-18 08:12

10 楼

这个主要决定于主申请人的情况。如果主申请人没有任何犯罪纪录，当然转H4和不转没
有任何区别。

【在 y****i 的大作中提到】

: 虽说pending期间是合法的，但万一出状况岂不是要立刻走人？

h*r2013-12-18 08:12

11 楼

是啊，想不开想不开，
在Google研究院见过Sam,非常smart一人，而且看起来超级年轻。第一次看见时，我还
以为他是phd.student,结果人家都是full professor了。
什么时候去的nyu不知道。

【在 d******e 的大作中提到】

: 真TMD想不开

t*m2013-12-18 08:12

12 楼

服务器没开防火墙。番茄的放火墙在界面里关不掉。换个路由器(Uverse自带的那个)就
没问题。所以问题应该是路由器硬件或者番茄固件的。番茄的那个log看的一团雾水。
连我想找的那个服务都看不见。

【在 s*****g 的大作中提到】

: Can your firewall appliance recognize (meaning stateful inspection) your
: application so that it can dynamically open up RTP/UDP ports negotiated in
: control channel? By default most distributions have Iptable allowing
: everything, A simple tcpdump on server will almost immediately tell you
: where the problem is, a simple flow debug on firewall will do the job also.
:
: ISP

y*i2013-12-18 08:12

13 楼

主申请人是标准良民一个。

k*02013-12-18 08:12

14 楼

是不是小孩有问题导致的？

【在 d******e 的大作中提到】

: 真TMD想不开

t*m2013-12-18 08:12

15 楼

一下是我的iptables。端口6500和8443上的服务没法从外网访问。那位高人看下？
Chain INPUT (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,
ESTABLISHED
shlimit tcp -- anywhere anywhere tcp dpt:ssh
state NEW
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere limit: avg 1/
sec burst 5
ACCEPT udp -- anywhere anywhere udp dpts:33434:
33534 limit: avg 5/sec burst 5
ACCEPT udp -- anywhere anywhere udp spt:bootps
dpt:bootpc
ACCEPT tcp -- anywhere anywhere tcp dpt:
webcache
Chain FORWARD (policy DROP)
target prot opt source destination
all -- anywhere anywhere account:
network/netmask: 192.168.1.0/255.255.255.0 name: lan
all -- anywhere anywhere account:
network/netmask: 192.168.10.0/255.255.255.0 name: lan1
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,
RST/SYN TCPMSS clamp to PMTU
L7in all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,
ESTABLISHED
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
wanin all -- anywhere anywhere
wanout all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere 192.168.1.167
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain L7in (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere LAYER7 l7proto
skypetoskype
RETURN all -- anywhere anywhere LAYER7 l7proto
youtube-2012
RETURN all -- anywhere anywhere LAYER7 l7proto
flash
RETURN all -- anywhere anywhere LAYER7 l7proto
httpvideo
RETURN all -- anywhere anywhere LAYER7 l7proto
rtp
RETURN all -- anywhere anywhere LAYER7 l7proto
rtmp
RETURN all -- anywhere anywhere LAYER7 l7proto
rtmpt
RETURN all -- anywhere anywhere LAYER7 l7proto
shoutcast
RETURN all -- anywhere anywhere LAYER7 l7proto
irc
Chain shlimit (1 references)
target prot opt source destination
all -- anywhere anywhere recent: SET
name: shlimit side: source
DROP all -- anywhere anywhere recent: UPDATE
seconds: 60 hit_count: 4 name: shlimit side: source
Chain wanin (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere 192.168.1.99 tcp dpt:6588
ACCEPT udp -- anywhere 192.168.1.86 udp dpt:5063
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:8443
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:ftp
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:https
ACCEPT tcp -- anywhere 192.168.1.167 tcp multiport
dports pop3,pop3s
ACCEPT tcp -- anywhere 192.168.1.99 tcp dpt:
webcache
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:6500
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:smtp
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:7777
ACCEPT tcp -- anywhere 192.168.1.99 tcp dpt:8312
ACCEPT tcp -- anywhere 192.168.1.167 tcp dpt:5143
ACCEPT udp -- anywhere 192.168.1.167 udp dpt:5153
ACCEPT tcp -- anywhere 192.168.1.170 tcp dpt:6143
ACCEPT udp -- anywhere 192.168.1.170 udp dpt:6153
ACCEPT tcp -- anywhere 192.168.1.170 tcp dpt:57753
Chain wanout (1 references)
target prot opt source destination

b*e2013-12-18 08:12

16 楼

良民就不要花冤枉钱了。如果是公司出钱，那就也转。

【在 y****i 的大作中提到】

: 主申请人是标准良民一个。