Ïðèâåò
Ó ìåíÿ wl500gp. ß òîëüêî ÷òî óñòàíîâèëè ïðîøèâêà 1.9.2.7-RTN-r4051.
×åðåç âåá âêëþ÷åí SSH è îñòàíîâèë FTP, Telnet, UPnP. Äëÿ òåñòèðîâàíèÿ firewall ÿ ïûòàëñÿ âîéòè ÷åðåç WAN ñ SSH, è ýòî áûëî óñïåøíî. ß ïðîñìîòðåë ïîðòà ñ ïðîñòîé ñêàíåð, è ýòî ïîêàçûâàåò, êàê ïîðò 22 îòêðûò. Ýòî ñòðàííî, ïîñêîëüêó ÿ íå ïîçâîëèë SSH èçâíå. ß òîëüêî ÷òî ñîçäàë ôàéëû â /usr /local/sbin, íî âñå ôàéëû ïóñòûå.(post-firewall, etc...)
Ìîæåòå ëè âû ïîìî÷ü ìíå ïîíÿòü, ïî÷åìó firewall ïîçâîëÿåò SSH è ïîêàçûâàåò ïîðò îòêðûò.  ìîåì ïîíèìàíèè ýòî äîëæíû áûòü çàêðûòû îò ãëîáàëüíîé ñåòè.
Âîò òå ïàðàìåòðû firewall êàê ïîêàçàíî íà "Status & Log - Diagnostic Information" - ÿ íè÷åãî íå ìåíÿë, è ýòî äîëæíî áûòü ïî óìîë÷àíèþ
Ó ìåíÿ wl500gp. ß òîëüêî ÷òî óñòàíîâèëè ïðîøèâêà 1.9.2.7-RTN-r4051.
×åðåç âåá âêëþ÷åí SSH è îñòàíîâèë FTP, Telnet, UPnP. Äëÿ òåñòèðîâàíèÿ firewall ÿ ïûòàëñÿ âîéòè ÷åðåç WAN ñ SSH, è ýòî áûëî óñïåøíî. ß ïðîñìîòðåë ïîðòà ñ ïðîñòîé ñêàíåð, è ýòî ïîêàçûâàåò, êàê ïîðò 22 îòêðûò. Ýòî ñòðàííî, ïîñêîëüêó ÿ íå ïîçâîëèë SSH èçâíå. ß òîëüêî ÷òî ñîçäàë ôàéëû â /usr /local/sbin, íî âñå ôàéëû ïóñòûå.(post-firewall, etc...)
Ìîæåòå ëè âû ïîìî÷ü ìíå ïîíÿòü, ïî÷åìó firewall ïîçâîëÿåò SSH è ïîêàçûâàåò ïîðò îòêðûò.  ìîåì ïîíèìàíèè ýòî äîëæíû áûòü çàêðûòû îò ãëîáàëüíîé ñåòè.
Âîò òå ïàðàìåòðû firewall êàê ïîêàçàíî íà "Status & Log - Diagnostic Information" - ÿ íè÷åãî íå ìåíÿë, è ýòî äîëæíî áûòü ïî óìîë÷àíèþ
Code:
IP Tables
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
9 360 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
547 49666 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 ctstate NEW
320 28917 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 ctstate NEW
0 0 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4
0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
3 156 BRUTE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x17/0x02
454 47038 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 249 packets, 17722 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
7 280 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DROP all -- !br0 vlan1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT
0 0 DROP all -- * br0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 937 packets, 696K bytes)
pkts bytes target prot opt in out source destination
Chain BRUTE (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 600 hit_count: 5 name: BRUTE side: source
3 156 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: BRUTE side: source
Chain MACS (0 references)
pkts bytes target prot opt in out source destination
Chain SECURITY (0 references)
pkts bytes target prot opt in out source destination
0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 1/sec burst 5
0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5
0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/sec burst 5
0 0 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/sec burst 5
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UPNP (0 references)
pkts bytes target prot opt in out source destination
Chain logaccept (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate NEW LOG flags 39 level 4 prefix `ACCEPT '
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate NEW LOG flags 39 level 4 prefix `DROP '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
--------------------------------------------------------------------------------
IP Tables NAT
Chain PREROUTING (policy ACCEPT 719 packets, 73857 bytes)
pkts bytes target prot opt in out source destination
206 25457 VSERVER all -- * * 0.0.0.0/0 192.168.11.2
Chain POSTROUTING (policy ACCEPT 22 packets, 1479 bytes)
pkts bytes target prot opt in out source destination
129 8682 MASQUERADE all -- * vlan1 !192.168.11.2 0.0.0.0/0
0 0 MASQUERADE all -- * br0 192.168.10.0/24 192.168.10.0/24
Chain OUTPUT (policy ACCEPT 22 packets, 1479 bytes)
pkts bytes target prot opt in out source destination
Chain UPNP (0 references)
pkts bytes target prot opt in out source destination
Chain VSERVER (1 references)
pkts bytes target prot opt in out source destination