iptables 端口转发

运维 系统运维
iptables 是与最新的 2.6.x 版本Linux 内核集成的 IP 信息包过滤系统。上篇文章我给大家讲了iptables 端口映射的问题,本文我给大家带来的是:iptables 端口转发

iptables是一款好用的系统工具,本文讲下iptables 端口转发

  我首先运行以下script

  #filename gw.sh

  PATH=$PATH:/usr/sbin:/sbin

  echo "1" >/proc/sys/net/ipv4/ip_forward

  modprobe ip_tables

  modprobe ip_nat_ftp

  modprobe ip_conntrack_ftp

  iptables -F INPUT

  iptables -F FORWARD

  iptables -F POSTROUTING -t nat

  iptables -F PREROUTING -t nat

  iptables -P FORWARD DROP

  iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT

  iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

  iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE

  iptables -t nat -A PREROUTING -p tcp -d 192.168.1.201 --dport 80 -j DNAT --to 10.0.0.2:80

  iptables -A FORWARD -p tcp -d 192.168.1.201 --dport 80 -j ACCEPT

  iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 80 -j ACCEPT

  然后在外部访问,没问题。

  然后我改了一下这个script:

  #filename gw.sh

  PATH=$PATH:/usr/sbin:/sbin

  echo "1" >/proc/sys/net/ipv4/ip_forward

  modprobe ip_tables

  modprobe ip_nat_ftp

  modprobe ip_conntrack_ftp

  iptables -F INPUT

  iptables -F FORWARD

  iptables -F POSTROUTING -t nat

  iptables -F PREROUTING -t nat

  iptables -P FORWARD DROP

  iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT

  iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

  iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE

  iptables -t nat -A PREROUTING -p tcp -d 192.168.1.201 --dport 8000 -j DNAT --to 10.0.0.2:80

  iptables -A FORWARD -p tcp -d 192.168.1.201 --dport 8000 -j ACCEPT

  iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 80 -j ACCEPT

  #!/bin/sh

  PATH=$PATH:/usr/sbin:/sbin

  echo "1" >/proc/sys/net/ipv4/ip_forward

  modprobe ip_tables

  modprobe ip_nat_ftp

  modprobe ip_conntrack_ftp

  iptables -F INPUT

  iptables -F FORWARD

  iptables -F POSTROUTING -t nat

  iptables -F PREROUTING -t nat

  iptables -P FORWARD DROP

  iptables -t nat -P PREROUTING DROP

  iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT

  iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

  iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -j MASQUERADE

  iptables -t nat -A PREROUTING -p tcp -d 192.168.1.201 --dport 81 -j DNAT --to 10.0.

  0.2:80

  iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 80 -j ACCEPT

  iptables -t nat -A PREROUTING -p tcp -d 192.168.1.201 --dport 21 -j DNAT --to 10.0.

  0.2:21

  iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 21 -j ACCEPT

#p#

  看一我的规则:

  [root@redhat unixboy]# /sbin/iptables -L

  Chain INPUT (policy ACCEPT)

  target prot opt source destination

  Chain FORWARD (policy DROP)

  target prot opt source destination

  ACCEPT all -- 10.0.0.0/24 anywhere

  ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

  ACCEPT tcp -- anywhere 10.0.0.2 tcp dpt:http

  ACCEPT tcp -- anywhere 10.0.0.2 tcp dpt:ftp

  Chain OUTPUT (policy ACCEPT)

  target prot opt source destination

  [root@redhat unixboy]# /sbin/iptables -L -t nat

  Chain PREROUTING (policy DROP)

  target prot opt source destination

  DNAT tcp -- anywhere 192.168.1.201 tcp dpt:81 to:10.0.0.2:80

  DNAT tcp -- anywhere 192.168.1.201 tcp dpt:ftp to:10.0.0.2:21

  Chain POSTROUTING (policy ACCEPT)

  target prot opt source destination

  MASQUERADE all -- 10.0.0.0/24 anywhere

  Chain OUTPUT (policy ACCEPT)

  target prot opt source destination

通过上面的文章描述,我们找到iptables 端口转发的问题,并解决了他!希望对你们有用!

【编辑推荐】

责任编辑:赵鹏 来源: 网络转载
相关推荐

2011-03-16 12:55:00

iptables 端口

2011-03-16 10:12:27

LinuxIptables端口转发

2022-03-31 10:42:04

端口转发Linux

2011-03-18 08:52:23

Iptables

2011-03-16 13:09:10

iptables 端口

2011-03-16 15:52:04

关闭iptables

2021-04-08 10:23:51

autossh命令工具

2021-04-28 15:05:44

autossh命令Linux

2017-03-23 12:38:49

2011-03-16 10:43:36

2011-03-17 13:55:23

iptablesNAT端口映射

2011-03-16 13:29:33

iptables 端口

2011-03-16 09:53:25

2011-03-17 09:06:58

iptables映射端口

2019-10-29 16:30:10

FedoraSSH端口Linux

2021-05-06 15:38:54

autossh命令工具

2020-08-25 08:53:02

Linux端口转发

2019-07-25 15:15:54

端口映射服务器

2015-07-14 10:13:29

2013-04-22 10:07:08

点赞
收藏

51CTO技术栈公众号