问题:
for IP in ${aryTEST[@]}; do sudo iptables -A test -s $IP -j DROP ; done
Bad argument `DROP'
我运行的命令是:
ssh -p <port#> <user>@<host> "for IP in ${aryTEST[@]}; do sudo iptables -A test -s $IP -j DROP ; done"
ssh -p <port#> <user>@<host> 'for IP in ${aryTEST[@]}; do sudo iptables -A test -s $IP -j DROP ; done'
答案1:
转义美元符号($
)
如果你使用
ssh -p <port#> <user>@<host> "for IP in ${aryTEST[@]}; do sudo iptables -A test -s $IP -j DROP ; done"
for IP in 192.0.2.1 192.0.2.3 192.0.2.7; do sudo iptables -A test -s -j DROP ; done
但是你想要的是:
for IP in 192.0.2.1 192.0.2.3 192.0.2.7; do sudo iptables -A test -s $IP -j DROP ; done
需要在末尾计算数组,而另一个变量只在远程端计算:
ssh -p <port#> <user>@<host> "for IP in ${aryTEST[@]}; do sudo iptables -A test -s $IP -j DROP ; done"
答案2:
首先,创建一个IPSet规则文件testset.ipset
,其中列出了你的IP地址:
create testset hash:ip family inet hashsize 1024 maxelem 65536
add testset <IP1>
add testset <IP2>
...
然后,将文件传输到远程主机,并运行以下命令:
ipset restore -! < testset.ipset
iptables -A test -p tcp -m set --match-set testset src -j DROP
相关文章