{"action":"created","issue":{"url":"https://api.github.com/repos/shadowsocks/shadowsocks-libev/issues/343","labels_url":"https://api.github.com/repos/shadowsocks/shadowsocks-libev/issues/343/labels{/name}","comments_url":"https://api.github.com/repos/shadowsocks/shadowsocks-libev/issues/343/comments","events_url":"https://api.github.com/repos/shadowsocks/shadowsocks-libev/issues/343/events","html_url":"https://github.com/shadowsocks/shadowsocks-libev/issues/343","id":94532765,"number":343,"title":"iptables howto enable udp relay(ss-tunnel) ?","user":{"login":"xsharp","id":36738,"avatar_url":"https://avatars.githubusercontent.com/u/36738?v=3","gravatar_id":"","url":"https://api.github.com/users/xsharp","html_url":"https://github.com/xsharp","followers_url":"https://api.github.com/users/xsharp/followers","following_url":"https://api.github.com/users/xsharp/following{/other_user}","gists_url":"https://api.github.com/users/xsharp/gists{/gist_id}","starred_url":"https://api.github.com/users/xsharp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xsharp/subscriptions","organizations_url":"https://api.github.com/users/xsharp/orgs","repos_url":"https://api.github.com/users/xsharp/repos","events_url":"https://api.github.com/users/xsharp/events{/privacy}","received_events_url":"https://api.github.com/users/xsharp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-12T04:27:08Z","updated_at":"2015-07-12T04:32:49Z","closed_at":null,"body":"ss-local / ss-redir 客户端连接服务器没有问题.\r\nss-tunnel 连接服务器进行DNS查询时无响应. 是否 Iptables 需要做啥策略?\r\n如果我在 # Allow source IPs 下面加上我当前IP,则可以正常返回DNS查询数据, 但我是拨号,不能这么做:(\r\n\r\n我是这样设置的:\r\n\r\n```\r\n*nat\r\n:PREROUTING ACCEPT [0:0]\r\n:INPUT ACCEPT [0:0]\r\n:OUTPUT ACCEPT [0:0]\r\n:POSTROUTING ACCEPT [0:0]\r\n\r\n# PPTP\r\n# -A POSTROUTING -s 192.168.217.0/24 -o eth0 -j MASQUERADE\r\n# ShadowVPN\r\n-A POSTROUTING -o eth0 -m comment --comment \"eth0 (shadowvpn)\" -j MASQUERADE\r\nCOMMIT\r\n\r\n*mangle\r\n:PREROUTING ACCEPT [0:0]\r\n:INPUT ACCEPT [0:0]\r\n:FORWARD ACCEPT [0:0]\r\n:OUTPUT ACCEPT [0:0]\r\n:POSTROUTING ACCEPT [0:0]\r\n-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu\r\nCOMMIT\r\n\r\n*filter\r\n:INPUT ACCEPT [0:0]\r\n:FORWARD ACCEPT [0:0]\r\n:OUTPUT ACCEPT [0:0\r\n\r\n#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0\r\n-A INPUT -i lo -j ACCEPT\r\n-A INPUT -d 127.0.0.0/8 -j REJECT\r\n\r\n# Denied IPs\r\n\r\n#  Accept all established inbound connections\r\n-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\r\n\r\n#  Allow all outbound traffic - you can modify this to only allow certain traffic\r\n-A OUTPUT -j ACCEPT\r\n\r\n#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).\r\n-A INPUT -p tcp --dport 80 -j ACCEPT\r\n-A INPUT -p tcp --dport 443 -j ACCEPT\r\n\r\n#  Allow SSH connections\r\n-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT\r\n\r\n#  Allow ping(see: http://www.nthelp.com/icmp.html)\r\n-A INPUT -p icmp --icmp-type echo-request -j ACCEPT\r\n\r\n#  Log iptables denied calls\r\n#-A INPUT -m limit --limit 25/min -j LOG --log-prefix \"iptables denied: \" --log-level 7\r\n\r\n# Allow Ftp connections from anywhere\r\n-A INPUT -p tcp --dport 21 -j ACCEPT\r\n\r\n# Allow source IPs\r\n\r\n\r\n# PPTP\r\n-A INPUT -i eth0 -p tcp --dport 1723 -j ACCEPT\r\n-A INPUT -i eth0 -p gre -j ACCEPT\r\n-A FORWARD -i ppp+ -o eth0 -j ACCEPT\r\n-A FORWARD -i eth0 -o ppp+ -j ACCEPT\r\n\r\n# ShadowVPN\r\n-A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT\r\n-A FORWARD -i tun0 -o eth0 -j ACCEPT\r\n\r\n#  Drop all other inbound - default deny unless explicitly allowed policy\r\n-A INPUT -j DROP\r\n-A FORWARD -j DROP\r\n\r\nCOMMIT\r\n```"},"comment":{"url":"https://api.github.com/repos/shadowsocks/shadowsocks-libev/issues/comments/120686227","html_url":"https://github.com/shadowsocks/shadowsocks-libev/issues/343#issuecomment-120686227","issue_url":"https://api.github.com/repos/shadowsocks/shadowsocks-libev/issues/343","id":120686227,"user":{"login":"xsharp","id":36738,"avatar_url":"https://avatars.githubusercontent.com/u/36738?v=3","gravatar_id":"","url":"https://api.github.com/users/xsharp","html_url":"https://github.com/xsharp","followers_url":"https://api.github.com/users/xsharp/followers","following_url":"https://api.github.com/users/xsharp/following{/other_user}","gists_url":"https://api.github.com/users/xsharp/gists{/gist_id}","starred_url":"https://api.github.com/users/xsharp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xsharp/subscriptions","organizations_url":"https://api.github.com/users/xsharp/orgs","repos_url":"https://api.github.com/users/xsharp/repos","events_url":"https://api.github.com/users/xsharp/events{/privacy}","received_events_url":"https://api.github.com/users/xsharp/received_events","type":"User","site_admin":false},"created_at":"2015-07-12T04:32:49Z","updated_at":"2015-07-12T04:32:49Z","body":"自觉跑google group去了"}}