Jason_conglin 2017-11-26 02:27 采纳率: 0%
浏览 2742
已结题

用iptables设置 android网络防火墙白名单失效

我用iptables命令设置网络白名单,命令如下:
iptables -A OUTPUT -d www.zhihu.com -j ACCEPT
iptables -A OUTPUT -j REJECT

短时间内会失效,1分钟到十分钟不等,有知道原因的吗?

失效后执行iptables-save显示的默认设置为:

iptables-save

Generated by iptables-save v1.4.20 on Sat Nov 25 21:13:10 2017

*security
:INPUT ACCEPT [85831:90333165]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [60997:5463885]
COMMIT

Completed on Sat Nov 25 21:13:10 2017

Generated by iptables-save v1.4.20 on Sat Nov 25 21:13:10 2017

*raw
:PREROUTING ACCEPT [29791:30082195]
:OUTPUT ACCEPT [57750:5340737]
:bw_raw_PREROUTING - [0:0]
:idletimer_raw_PREROUTING - [0:0]
:natctrl_raw_PREROUTING - [0:0]
:nm_mdmprxy_raw_pre - [0:0]
-A PREROUTING -j bw_raw_PREROUTING
-A PREROUTING -j idletimer_raw_PREROUTING
-A PREROUTING -j natctrl_raw_PREROUTING
-A bw_raw_PREROUTING -m owner --socket-exists
-A idletimer_raw_PREROUTING -i wlan0 -j IDLETIMER --timeout 15 --label 1 --send_nl_msg 1
-A nm_mdmprxy_raw_pre -p tcp -m multiport --ports 5060 -j NOTRACK
-A nm_mdmprxy_raw_pre -p udp -m multiport --ports 5060 -j NOTRACK
COMMIT

Completed on Sat Nov 25 21:13:10 2017

Generated by iptables-save v1.4.20 on Sat Nov 25 21:13:10 2017

*nat
:PREROUTING ACCEPT [665:163628]
:INPUT ACCEPT [174:35741]
:OUTPUT ACCEPT [26701:1805217]
:POSTROUTING ACCEPT [9379:691727]
:natctrl_nat_POSTROUTING - [0:0]
:oem_nat_pre - [0:0]
-A PREROUTING -j oem_nat_pre
-A POSTROUTING -j natctrl_nat_POSTROUTING
COMMIT

Completed on Sat Nov 25 21:13:10 2017

Generated by iptables-save v1.4.20 on Sat Nov 25 21:13:10 2017

*mangle
:PREROUTING ACCEPT [29788:30081904]
:INPUT ACCEPT [29402:29974848]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [57743:5339934]
:POSTROUTING ACCEPT [28151:2828777]
:bw_mangle_POSTROUTING - [0:0]
:idletimer_mangle_POSTROUTING - [0:0]
:natctrl_mangle_FORWARD - [0:0]
:nm_mdmprxy_dl_ping6_marker - [0:0]
:nm_mdmprxy_icmp_pkt_marker - [0:0]
:nm_mdmprxy_mark_prov_chain - [0:0]
:nm_mdmprxy_mngl_post - [0:0]
:nm_mdmprxy_mngl_pre_ex - [0:0]
:nm_mdmprxy_mngl_pre_spi - [0:0]
:nm_mdmprxy_mngl_pre_tee - [0:0]
:nm_mdmprxy_pkt_forwarder - [0:0]
:nm_mdmprxy_pkt_marker - [0:0]
:qcom_qos_filter_POSTROUTING - [0:0]
:qcom_qos_reset_POSTROUTING - [0:0]
-A PREROUTING -i wlan0 -j nm_mdmprxy_pkt_marker
-A PREROUTING -j nm_mdmprxy_icmp_pkt_marker
-A INPUT -i wlan0 -j MARK --set-xmark 0x3007d/0xffffffff
-A FORWARD -j natctrl_mangle_FORWARD
-A POSTROUTING -j qcom_qos_reset_POSTROUTING
-A POSTROUTING -j qcom_qos_filter_POSTROUTING
-A POSTROUTING -j bw_mangle_POSTROUTING
-A POSTROUTING -j idletimer_mangle_POSTROUTING
-A bw_mangle_POSTROUTING -m owner --socket-exists
-A idletimer_mangle_POSTROUTING -o wlan0 -j IDLETIMER --timeout 15 --label 1 --send_nl_msg 1
-A nm_mdmprxy_mark_prov_chain -p tcp -m tcp --dport 32000:36999 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_mark_prov_chain -p udp -m udp --dport 32000:36999 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_mngl_post -m mark --mark 0x9 -j MARK --set-xmark 0x0/0xffffffff
-A nm_mdmprxy_mngl_pre_ex -p tcp -m tcp --dport 50010:50060 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_mngl_pre_ex -p udp -m udp --dport 50010:50060 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_mngl_pre_ex -p tcp -m tcp --dport 40100:40150 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_pkt_marker -p udp -m udp --sport 4500 --dport 32012 -m u32 --u32 "0x0>>0x16&0x3c@0x8=0x0" -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_pkt_marker -p udp -m udp --sport 4500 -m mark ! --mark 0x9 -j ACCEPT
-A nm_mdmprxy_pkt_marker -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A nm_mdmprxy_pkt_marker -j nm_mdmprxy_mark_prov_chain
-A nm_mdmprxy_pkt_marker -j nm_mdmprxy_mngl_pre_spi
-A nm_mdmprxy_pkt_marker -p tcp -m tcp --dport 5060 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_pkt_marker -p udp -m udp --dport 5060 -j MARK --set-xmark 0x9/0xffffffff
-A nm_mdmprxy_pkt_marker -j nm_mdmprxy_mngl_pre_ex
-A nm_mdmprxy_pkt_marker -m mark --mark 0x9 -j nm_mdmprxy_pkt_forwarder
COMMIT

Completed on Sat Nov 25 21:13:10 2017

Generated by iptables-save v1.4.20 on Sat Nov 25 21:13:10 2017

*filter
:INPUT ACCEPT [28:4401]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fw_dozable - [0:0]
-A OUTPUT -d 47.95.51.100/32 -j ACCEPT
-A OUTPUT -j REJECT --reject-with icmp-port-unreachable
-A fw_dozable -i lo -o lo -j RETURN
-A fw_dozable -p tcp -m tcp --tcp-flags RST RST -j RETURN
-A fw_dozable -m owner --uid-owner 0-9999 -j RETURN
-A fw_dozable -m owner --uid-owner 1001 -j RETURN
-A fw_dozable -m owner --uid-owner 1027 -j RETURN
-A fw_dozable -m owner --uid-owner 10009 -j RETURN
-A fw_dozable -m owner --uid-owner 10012 -j RETURN
-A fw_dozable -m owner --uid-owner 10013 -j RETURN
-A fw_dozable -m owner --uid-owner 10031 -j RETURN
-A fw_dozable -m owner --uid-owner 10035 -j RETURN
-A fw_dozable -m owner --uid-owner 10069 -j RETURN
-A fw_dozable -m owner --uid-owner 10097 -j RETURN
-A fw_dozable -m owner --uid-owner 10100 -j RETURN
-A fw_dozable -m owner --uid-owner 10105 -j RETURN
-A fw_dozable -m owner --uid-owner 10108 -j RETURN
-A fw_dozable -m owner --uid-owner 10113 -j RETURN
-A fw_dozable -j DROP
COMMIT

Completed on Sat Nov 25 21:13:10 2017

  • 写回答

2条回答 默认 最新

  • COCO_AS 2017-11-26 03:06
    关注

    iptables原则上只能设置ip名单, 而不是域名, 如果想设置域名,需要用应用层协议的代理来实现

    可以参考

    https://serverfault.com/a/209022/193263

    评论

报告相同问题?

悬赏问题

  • ¥30 帮我写一段可以读取LD2450数据并计算距离的Arduino代码
  • ¥15 C#调用python代码(python带有库)
  • ¥15 矩阵加法的规则是两个矩阵中对应位置的数的绝对值进行加和
  • ¥15 活动选择题。最多可以参加几个项目?
  • ¥15 飞机曲面部件如机翼,壁板等具体的孔位模型
  • ¥15 vs2019中数据导出问题
  • ¥20 云服务Linux系统TCP-MSS值修改?
  • ¥20 关于#单片机#的问题:项目:使用模拟iic与ov2640通讯环境:F407问题:读取的ID号总是0xff,自己调了调发现在读从机数据时,SDA线上并未有信号变化(语言-c语言)
  • ¥20 怎么在stm32门禁成品上增加查询记录功能
  • ¥15 Source insight编写代码后使用CCS5.2版本import之后,代码跳到注释行里面