iptables 的问题请教。

[zander]

admin@R7000-9B31:/# ifconfig wl1.3
wl1.3     Link encap:Ethernet  HWaddr DE:EF:09:A5:9B:38
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:42189 errors:0 dropped:0 overruns:0 frame:1633
          TX packets:59226 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5041910 (4.8 MiB)  TX bytes:62593037 (59.6 MiB)

这是启用 asuswrt-merlin 自带的客人网络功能后系统产生的接口，我想对这个走这个接口的设备做一些限制。

不过测试命令 iptables -A INPUT -i wl1.3 -j DROP 时发现没有起到拦截的效果，在 FORWARD 链下试了试也没用，没有搜索出个所以然来，有谁清楚这里面的道道吗。 是不是和下面的某个命令有冲突？下面是系统重启后 iptables -S 得到的结果。

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N FUPNP
-N NSFW
-N PControls
-N SECURITY
-N SECURITY_PROTECT
-N logaccept
-N logdrop
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD ! -i br0 -o ppp0 -j DROP
-A FORWARD ! -i br0 -o eth0 -j DROP
-A FORWARD -i eth0 -m state --state INVALID -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -j NSFW
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A FORWARD -i br0 -j ACCEPT
-A FUPNP -d 192.168.50.100/32 -p tcp -m tcp --dport 22000 -j ACCEPT
-A FUPNP -d 192.168.50.100/32 -p tcp -m tcp --dport 22000 -j ACCEPT
-A PControls -j ACCEPT
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A SECURITY -p icmp -m icmp --icmp-type 8 -j DROP
-A SECURITY -j RETURN
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP

以及 ebtables 的结果。

admin@R7000-9B31:/# ebtables  -L
Bridge table: filter

Bridge chain: INPUT, entries: 0, policy: ACCEPT

Bridge chain: FORWARD, entries: 2, policy: ACCEPT
-i wl1.3 -j DROP
-o wl1.3 -j DROP

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT