iptables之nat转发
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了iptables之nat转发相关的知识，希望对你有一定的参考价值。
主要分为路由前转发PREROUTING，和路由后转发POSTROUTING。
何为路由前？也就是从外部传入数据，在到达主机网卡，还未进入网卡的瞬间。
何为路由后？也就是从外部传入数据，进入并经过主机某个网卡后，向外传出数据的瞬间。
一个简单的模型如下：
外部数据------>主机网卡（如eth0、eth1等）------>目的地
路由前 路由后
首先把转发策略打开
[[email protected]~]# vi /etc/sysctl.conf net.ipv4.ip_forward=1 [[email protected]~]# sysctl -p
一、路由前转发
[[email protected] ~]# iptables -t nat -A POSTROUTING -d 192.168.1.125 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.125:8000
查看路由前nat表
[[email protected] ~]# iptables -t nat -vnL PREROUTING --line-number Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 52 6436 PREROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0 2 52 6436 PREROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 3 52 6436 PREROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 4 0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.125.0 tcp dpt:80 to:192.168.1.125:8000 5 0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.1.125 tcp dpt:80 to:192.168.1.125:8000 6 0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.1.125 tcp dpt:80 to:192.168.1.125
删除路由前第一条规则，注意删除后规则标签会变化
[[email protected] ~]#iptables -t nat -D PREROUTING 1 [[email protected] ~]# iptables -t nat -vnL PREROUTING --line-number Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 148 16474 PREROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 2 148 16474 PREROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 3 0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.125.0 tcp dpt:80 to:192.168.1.125:8000 4 0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.1.125 tcp dpt:80 to:192.168.1.125:8000 5 0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.1.125 tcp dpt:80 to:192.168.1.125
清空路由前nat表
[[email protected] ~]# iptables -t nat -F PREROUTING [[email protected] ~]# iptables -t nat -vnL PREROUTING --line-number Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination
二、路由后转发
[[email protected] ~]# iptables -t nat -A POSTROUTING -d 192.168.125 -p tcp --dport 80 -j DNAT --to-source 192.168.1.125:8000
查看路由后nat表
[[email protected] ~]# iptables -t nat -vnL POSTROUTING --line-number Chain POSTROUTING (policy ACCEPT 1 packets, 76 bytes) num pkts bytes target prot opt in out source destination 1 2 267 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24 2 0 0 RETURN all -- * * 192.168.122.0/24 255.255.255.255 3 0 0 MASQUERADE tcp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 4 0 0 MASQUERADE udp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 5 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 6 129 10207 POSTROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0 7 129 10207 POSTROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 8 129 10207 POSTROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 9 0 0 SNAT tcp -- * * 192.168.125.0 0.0.0.0/0 tcp dpt:80 to:192.168.1.125:8000 10 0 0 SNAT tcp -- * eth0 192.168.1.125 0.0.0.0/0 tcp dpt:80 to:192.168.1.125:8000
删除路由后第二条规则，注意删除后规则标签会变化
[[email protected] ~]# iptables -t nat -D POSTROUTING 2 [[email protected] ~]# iptables -t nat -vnL POSTROUTING --line-number Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 2 267 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24 2 0 0 MASQUERADE tcp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 3 0 0 MASQUERADE udp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 4 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 5 133 10511 POSTROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0 6 133 10511 POSTROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 7 133 10511 POSTROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 8 0 0 SNAT tcp -- * * 192.168.125.0 0.0.0.0/0 tcp dpt:80 to:192.168.1.125:8000 9 0 0 SNAT tcp -- * eth0 192.168.1.125 0.0.0.0/0 tcp dpt:80 to:192.168.1.125:8000
清空路由后nat表
[[email protected] ~]# iptables -t nat -F POSTROUTING [[email protected] ~]# iptables -t nat -vnL POSTROUTING --line-number Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination
清空所有nat表
[[email protected] ~]# iptables -t nat -F
特别注意：以上所有命令执行后的结果都是保存在内存中，重启系统后重置。要执行：
[[email protected] ~]# /sbin/iptables-save
命令保存到磁盘中。不同系统命令略有区别，这里是RHEL7或Centos7
本文出自 “运维笔记” 博客，请务必保留此出处http://quliren.blog.51cto.com/9849266/1943295
以上是关于iptables之nat转发的主要内容，如果未能解决你的问题，请参考以下文章