iptables nat 表应用

时间 2019-11-13

原文原文链接

nat 表应用

A 机器两块网卡 ens33(192.168.5.130),ens37(192.168.100.1),ens33能够上外网，ens37仅仅是内部网络，B机器只有ens37(192.168.100.100),和A机器ens37能够相互通讯互联。
需求1：可让B机器链接外网
A机器上打开路由转发echo "1">/proc/sys/net/ipv4/ip_forward
A上执行iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o ens33 -j MASQUERADE
B上设置网关为192.168.100.1
需求2：C机器只能和A通讯，让C机器能够直接连通B机器的22端口
A上打开路由转发 echo "1" >/proc/sys/net/ipv4/ip_forward
A上执iptables -t nat -A PREROUTING -d 192.168.5.130 -p tcp --dport 1122 -j DNAT --to 192.168.5.130
A上执行iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to 192.168.133.130
B上设置网关为192.168.100.1

在虚拟机上添加网卡第二台机器上添加一块网卡 python

[root@xuexi-001 ~]# ifconfig 
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.5.130  netmask 255.255.255.0  broadcast 192.168.5.255
        inet6 fe80::9625:3e1d:12c7:4fe6  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:b3:a2:bf  txqueuelen 1000  (Ethernet)
        RX packets 120  bytes 10318 (10.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 72  bytes 8791 (8.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.5.150  netmask 255.255.255.0  broadcast 192.168.5.255
        ether 00:0c:29:b3:a2:bf  txqueuelen 1000  (Ethernet)

ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::44c4:9bed:dd1f:6c01  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:b3:a2:c9  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 22  bytes 3300 (3.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 72  bytes 5736 (5.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 72  bytes 5736 (5.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

设置A机器的第二块网卡ens37网卡的IP 为192.168.100.1网络

[root@xuexi-001 ~]# ifconfig ens37 192.168.100.1/24  ······ 这样设置IP 为临时生效，系统重启后就失效了
[root@xuexi-001 ~]# ifconfig ens37
ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.100.1  netmask 255.255.255.0  broadcast 192.168.100.255
        inet6 fe80::20c:29ff:feb3:a2c9  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:b3:a2:c9  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 61  bytes 9802 (9.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

设置B机器的网卡ens37 的IP为192.168.100.100tcp

[root@xuexi-001 ~]# ifconfig ens37 192.168.100.100/24  ······ 这样设置IP 为临时生效，系统重启后就失效了
[root@xuexi-001 ~]# ifconfig ens37
ens37: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.100.100  netmask 255.255.255.0  broadcast 192.168.100.255
        inet6 fe80::20c:29ff:feb3:a2c9  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:b3:a2:c9  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 61  bytes 9802 (9.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

已经知足需求AB两台机器能够相互使用内网互联，AB机器内网不能访问外网。oop

需求1：可让B机器链接外网rest

A机器上打开路由转发echo "1">/proc/sys/net/ipv4/ip_forwardcode

/proc/sys/net/ipv4/ip_forward 这个配置文件默认是0 是关闭的须要改为“1”，“1”表明打开路由转发。blog

[root@xuexi-001 ~]# cat /proc/sys/net/ipv4/ip_forward
0
[root@xuexi-001 ~]# echo "1" > /proc/sys/net/ipv4/ip_forward
[root@xuexi-001 ~]# cat /proc/sys/net/ipv4/ip_forward
1
[root@xuexi-001 ~]# iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o ens33 -j MASQUERADE
[root@xuexi-001 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    52 PREROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    1    52 PREROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    1    52 PREROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  117  8880 OUTPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  117  8880 POSTROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  117  8880 POSTROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  117  8880 POSTROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      ens33   192.168.100.0/24     0.0.0.0/0

B上设置网关为192.168.100.1ip

[root@xuexi-001 ~]# route add default gw 192.168.100.1

B机器能够链接公网通讯 B机器链接外网须要设置DNS，设置DNS须要配置文件 vi /etc/resolv.conf路由

需求2：C机器只能和A通讯，让C机器能够直接连通B机器的22端口get
A上打开路由转发 echo "1" >/proc/sys/net/ipv4/ip_forward
A上执行iptables -t nat -A PREROUTING -d 192.168.5.130 -p tcp --dport 1122 -j DNAT --to 192.168.100.100:22

[root@xuexi-001 ~]# iptables -t nat -A PREROUTING -d 192.168.5.130 -p tcp --dport 1122 -j DNAT --to 192.168.100.100:22 
[root@xuexi-001 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  111  7144 PREROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  111  7144 PREROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  111  7144 PREROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            192.168.5.130        tcp dpt:1122 to:192.168.100.100:22

A上执行iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to 192.168.5.130

[root@xuexi-001 ~]# iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to 192.168.5.130
[root@xuexi-001 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  111  7144 PREROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  111  7144 PREROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  111  7144 PREROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            192.168.5.130        tcp dpt:1122 to:192.168.100.100:22

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  145 10993 OUTPUT_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  151 11497 POSTROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  151 11497 POSTROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
  151 11497 POSTROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 SNAT       all  --  *      *       192.168.100.100      0.0.0.0/0            to:192.168.5.130

B上设置网关为192.168.100.1

iptables 规则备份和恢复

iptables - save > /tmp/ipt.txt 备份

iptables - restore < /tmp/ipt.txt 恢复