Linux iptables 端口转发
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Linux iptables 端口转发相关的知识，希望对你有一定的参考价值。
准备：
1， UDP端口范围映射
2， tcp 端口范围映射
3， 本机端口转发
4， 单个端口转发
准备：
打开转发 [[email protected] ~]# cat /etc/sysctl.conf | grep net.ipv4.ip_forward net.ipv4.ip_forward = 1 清空规则，修改默认策略，重要数据请备份 [[email protected] ~]# iptables -F -t nat [[email protected] ~]# iptables -X -t nat [[email protected] ~]# iptables -P INPUT DROP [[email protected] ~]# iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [[email protected] ~]# 删除reject [[email protected] ~]# vim /etc/sysconfig/iptables [[email protected] ~]# service iptables restart
1， UDP端口范围映射
一一匹配： [[email protected] ~]# iptables -t nat -A PREROUTING -p udp --dport 5000:6000 -j DNAT --to 192.168.66.2:5000-6000 【注意】这样写，将导致不可预测的端口转发匹配： [[email protected] ~]# iptables -t nat -A PREROUTING -p udp --dport 5000:5010 -j DNAT --to 192.168.66.2:6000-6010 【nat内机器：192.168.66.2】端口转发匹配验证，输出源端口是9999 [[email protected] ~]# tcpdump -i eth0 -tnn port 9999 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes IP 172.16.20.245.9999 > 192.168.66.2.5500: UDP, length 1 IP 172.16.20.245.9999 > 192.168.66.2.5500: UDP, length 1 IP 172.16.20.245.9999 > 192.168.66.2.5501: UDP, length 1 IP 172.16.20.245.9999 > 192.168.66.2.5501: UDP, length 1 【nat外机器：172.16.20.245】发送给nat机器，发出的数据包源端口是9999， 目的端口是5500-5555 sudo nc -v -u -p 9999 172.16.20.183 5500-5555 端口转发双向通信验证： nat里面的机器打开监听： [[email protected] ~]# nc -l -u 5555 nat外面的机器向nat 发送数据 nc -u 172.16.20.183 5555 互发数据，双方是可以收到的。 可以发现：端口映射完全匹配，双通互发数据成功！
2， tcp 端口范围映射
tcp 端口范围映射： [[email protected] ~]# iptables -t nat -A PREROUTING -p tcp --dport 2000:2500 -j DNAT --to 192.168.66.2:2000-2500 验证： 接收端：【nat内机器：192.168.66.2】 [[email protected] ~]# tcpdump -i eth0 -tnn portrange 2000-2500 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes IP 172.16.20.245.37446 > 192.168.66.2.2000: Flags [S], seq 1083771445, win 29200, options [mss 1460,sackOK,TS val 3864340 ecr 0,nop,wscale 7], length 0 IP 192.168.66.2.2000 > 172.16.20.245.37446: Flags [R.], seq 0, ack 1083771446, win 0, length 0 IP 172.16.20.245.47912 > 192.168.66.2.2001: Flags [S], seq 629593170, win 29200, options [mss 1460,sackOK,TS val 3864344 ecr 0,nop,wscale 7], length 0 IP 192.168.66.2.2001 > 172.16.20.245.47912: Flags [R.], seq 0, ack 629593171, win 0, length 0 IP 172.16.20.245.34816 > 192.168.66.2.2002: Flags [S], seq 680276410, win 29200, options [mss 1460,sackOK,TS val 3864345 ecr 0,nop,wscale 7], length 0 IP 192.168.66.2.2002 > 172.16.20.245.34816: Flags [R.], seq 0, ack 680276411, win 0, length 0 IP 172.16.20.245.37508 > 192.168.66.2.2003: Flags [S], seq 1070666075, win 29200, options [mss 1460,sackOK,TS val 3864345 ecr 0,nop,wscale 7], length 0 IP 192.168.66.2.2003 > 172.16.20.245.37508: Flags [R.], seq 0, ack 1070666076, win 0, length 0 发送端：【nat外机器：172.16.20.245】发送给nat机器: sudo nc -z -w1 -v 172.16.20.183 2000-2500 nc: connect to 172.16.20.183 port 2000 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2001 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2002 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2003 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2004 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2005 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2006 (tcp) failed: Connection refused nc: connect to 172.16.20.183 port 2007 (tcp) failed: Connection refused 可以看见，虽然连接失败，但是发送的seq和ack回应包都有了，就差握手成功了。
3， 本机端口转发
[[email protected] ~]# iptables -t nat -A PREROUTING -p tcp --dport 1234 -j REDIRECT --to-ports 2345 [[email protected] ~]# nc -l -k 2345 #开启监听 1， 局域网其他主机直接来访问本机2345端口：看看tcpdump输出 [email protected]~$ nc 172.16.20.183 2345 #远程机访问本机172.16.20.183 2345 本机tcpdump输出 [[email protected] ~]# tcpdump -i eth0 host 172.16.20.245 -tnn IP 172.16.20.245.44706 > 172.16.20.183.2345: Flags [S], seq 33366406, win 29200, options [mss 1460,sackOK,TS val 4001328 ecr 0,nop,wscale 7], length 0 IP 172.16.20.183.2345 > 172.16.20.245.44706: Flags [R.], seq 0, ack 33366407, win 0, length 0 2，局域网其他主机直接来访问本机1234端口：看看tcpdump输出 [email protected]~$ nc 172.16.20.183 1234 #远程机访问本机172.16.20.183 1234 tcpdump在本机看一下： [[email protected] ~]# tcpdump -i eth0 host 172.16.20.245 -tnn IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [S], seq 3622624416, win 29200, options [mss 1460,sackOK,TS val 4047126 ecr 0,nop,wscale 7], length 0 IP 172.16.20.183.1234 > 172.16.20.245.47332: Flags [S.], seq 123535638, ack 3622624417, win 14480, options [mss 1460,sackOK,TS val 12018501 ecr 4047126,nop,wscale 6], length 0 IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [.], ack 1, win 229, options [nop,nop,TS val 4047126 ecr 12018501], length 0 IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [P.], seq 1:2, ack 1, win 229, options [nop,nop,TS val 4047282 ecr 12018501], length 1 IP 172.16.20.183.1234 > 172.16.20.245.47332: Flags [.], ack 2, win 227, options [nop,nop,TS val 12019122 ecr 4047282], length 0 IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [P.], seq 2:3, ack 1, win 229, options [nop,nop,TS val 4047325 ecr 12019122], length 1 IP 172.16.20.183.1234 > 172.16.20.245.47332: Flags [.], ack 3, win 227, options [nop,nop,TS val 12019297 ecr 4047325], length 0 IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [P.], seq 3:4, ack 1, win 229, options [nop,nop,TS val 4047353 ecr 12019297], length 1 可以看到三次握手成功！
4， 单个端口转发
端口转发 tcp模式：将访问本机1122端口数据包转发给192.168.66.2:5566 iptables -t nat -A PREROUTING -p tcp --dport 1122 -j DNAT --to-destination 192.168.66.2:5566 端口转发 udp模式：将访问本机2233端口数据包转发给192.168.66.2:4455 iptables -t nat -A PREROUTING -p udp --dport 2233 -j DNAT --to-destination 192.168.66.2:4455
本文出自 “李春利” 博客，请务必保留此出处http://990487026.blog.51cto.com/10133282/1939827
以上是关于Linux iptables 端口转发的主要内容，如果未能解决你的问题，请参考以下文章