iptables之SNAT与DNAT

时间：2018-04-14 23:02:17 阅读：356 评论：0 收藏：0 [点我收藏+]

Centos6.x NAT路由转发

一、网络拓扑结构

技术分享图片

二、实验环境

2.1、NAT服务器

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

eth1 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:8F

inet addr:172.16.1.100 Bcast:172.16.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed8f/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2 errors:0 dropped:0 overruns:0 frame:0

TX packets:10 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:684 (684.0 b) TX bytes:636 (636.0 b)

2.2、客户机端

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:172.16.1.10 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

三、服务配置

3.1、NAT服务器配置

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=10.0.0.100

NETMASK=255.255.255.0

GATEWAY=10.0.0.2 //配好网关，否则无法上网(在虚拟机的网络编辑器能找到网关)

DNS1=10.0.0.2

DNS2=223.5.5.5

IPV6INIT=no

USERCTL=no

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1(无网关)

DEVICE=eth1

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.1.100

NETMASK=255.255.255.0

IPV6INIT=no

USERCTL=no

3.2、内网客户端配置

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.1.10

NETMASK=255.255.255.0

GATEWAY=172.16.1.100

IPV6INIT=no

USERCTL=no

四、NAT服务器配置

4.1、开启路由转发

临时转发生效：

echo 1>/proc/sys/net/ipv4/ip_forward

永久转发生效：

(1)[root@Andy ~]# sed -i 's#net.ipv4.ip_forward = 0#net.ipv4.ip_forward = 1#g' /etc/sysctl.conf

(2)[root@Andy ~]# vim /etc/sysctl.conf
将net.ipv4.ip_forward的值从0改为1，否则服务器将不会进行包转发
[root@Andy ~]# sysctl -p //保存执行

在客户机测试

[root@Andy ~]# ping 10.0.0.100 //ping通说明开启成功

PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.

64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.137 ms

64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.068 ms

64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.071 ms

--- 10.0.0.100 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2512ms

rtt min/avg/max/mdev = 0.068/0.092/0.137/0.031 ms

4.2、配置NAT转发

服务器端

iptables-t nat -F //清除原有的nat表中的规则

iptables -F //清除原有的filter有中的规则

iptables -P FORWARD ACCEPT //允许IP转发

(1)静态IP

[root@Andy ~]# iptables -t nat -I POSTROUTING -s 172.16.1.0/24 -j SNAT --to 10.0.0.100

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 7 packets, 1009 bytes)

pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 3 packets, 206 bytes)

pkts bytes target prot opt in out source destination

5 353 SNAT all -- * * 172.16.1.0/24 0.0.0.0/0 to:10.0.0.100

Chain OUTPUT (policy ACCEPT 3 packets, 206 bytes)

pkts bytes target prot opt in out source destination

(2)动态IP

[root@Andy ~]# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

客户端测试

[root@Andy ~]# ping www.baidu.com //ping通说明NAT路由转发实验成功

PING www.a.shifen.com (180.149.132.151) 56(84) bytes of data.

64 bytes from 180.149.132.151: icmp_seq=1 ttl=127 time=11.3 ms

64 bytes from 180.149.132.151: icmp_seq=2 ttl=127 time=3.44 ms

64 bytes from 180.149.132.151: icmp_seq=3 ttl=127 time=4.69 ms

64 bytes from 180.149.132.151: icmp_seq=4 ttl=127 time=3.05 ms

--- www.a.shifen.com ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3371ms

rtt min/avg/max/mdev = 3.057/5.642/11.367/3.361 ms

Centos6.x NAT多路由转发

一、网络拓扑结构

技术分享图片

二、实验环境

2.1、NAT服务器( R1 )

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

eth1 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:8F

inet addr:172.16.1.100 Bcast:172.16.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed8f/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2 errors:0 dropped:0 overruns:0 frame:0

TX packets:10 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:684 (684.0 b) TX bytes:636 (636.0 b)

2.2、NAT服务器( R2 )

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:172.16.1.10 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

eth1 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:8F

inet addr:172.16.2.3 Bcast:172.16.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed8f/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2 errors:0 dropped:0 overruns:0 frame:0

TX packets:10 errors:0 dropped:0 overruns:0 carrier:0

2.3、客户机端

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:172.16.2.100 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

三、服务配置

3.1、NAT服务器配置( R1 )

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=10.0.0.100

NETMASK=255.255.255.0

GATEWAY=10.0.0.2 //配好网关，否则无法上网(在虚拟机的网络编辑器能找到网关)

DNS1=10.0.0.2

DNS2=223.5.5.5

IPV6INIT=no

USERCTL=no

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1(无网关)

DEVICE=eth1

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.1.100

NETMASK=255.255.255.0

IPV6INIT=no

USERCTL=no

3.2、NAT服务器配置( R2 )

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.1.10

NETMASK=255.255.255.0

GATEWAY=172.16.1.100

IPV6INIT=no

USERCTL=no

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1(无网关)

DEVICE=eth1

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.2.3

NETMASK=255.255.255.0

IPV6INIT=no

USERCTL=no

3.3、内网客户端配置

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.2.100

NETMASK=255.255.255.0

GATEWAY=172.16.2.3

IPV6INIT=no

USERCTL=no

四、NAT服务器配置

4.1、开启路由转发(R1)

临时转发生效：

echo 1>/proc/sys/net/ipv4/ip_forward

永久转发生效：

(1)[root@Andy ~]# sed -i 's#net.ipv4.ip_forward = 0#net.ipv4.ip_forward = 1#g' /etc/sysctl.conf

(2)[root@Andy ~]# vim /etc/sysctl.conf
将net.ipv4.ip_forward的值从0改为1，否则服务器将不会进行包转发
[root@Andy ~]# sysctl -p //保存执行

在R2上测试

[root@Andy ~]# ping 10.0.0.100 //ping通说明开启成功

PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.

64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.137 ms

64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.068 ms

64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.071 ms

--- 10.0.0.100 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2512ms

rtt min/avg/max/mdev = 0.068/0.092/0.137/0.031 ms

4.2、开启路由转发(R2)

临时转发生效：

echo 1>/proc/sys/net/ipv4/ip_forward

永久转发生效：

(1)[root@Andy ~]# sed -i 's#net.ipv4.ip_forward = 0#net.ipv4.ip_forward = 1#g' /etc/sysctl.conf

(2)[root@Andy ~]# vim /etc/sysctl.conf
将net.ipv4.ip_forward的值从0改为1，否则服务器将不会进行包转发
[root@Andy ~]# sysctl -p //保存执行

在客户机上测试

[root@Andy ~]# ping 172.16.1.10 //ping通说明开启成功

PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.

64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.137 ms

64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.068 ms

64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.071 ms

--- 10.0.0.100 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2512ms

rtt min/avg/max/mdev = 0.068/0.092/0.137/0.031 ms

4.3、配置NAT转发

服务器端(R1)

iptables-t nat -F //清除原有的nat表中的规则

iptables -F //清除原有的filter有中的规则

iptables -P FORWARD ACCEPT //允许IP转发

(1)静态IP

[root@Andy ~]# iptables -t nat -I POSTROUTING -s 172.16.1.0/24 -j SNAT --to 10.0.0.100

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 7 packets, 1009 bytes)

pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 3 packets, 206 bytes)

pkts bytes target prot opt in out source destination

5 353 SNAT all -- * * 172.16.1.0/24 0.0.0.0/0 to:10.0.0.100

Chain OUTPUT (policy ACCEPT 3 packets, 206 bytes)

pkts bytes target prot opt in out source destination

(2)动态IP

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

服务器端(R2)

iptables-t nat -F //清除原有的nat表中的规则

iptables -F //清除原有的filter有中的规则

iptables -P FORWARD ACCEPT //允许IP转发

(1)静态IP

[root@Andy ~]# iptables -t nat -I POSTROUTING -s 172.16.2.0/24 -j SNAT --to 172.16.1.10

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 7 packets, 1009 bytes)

pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 3 packets, 206 bytes)

pkts bytes target prot opt in out source destination

5 353 SNAT all -- * * 172.16.2.0/24 0.0.0.0/0 to:172.16.1.10

Chain OUTPUT (policy ACCEPT 3 packets, 206 bytes)

pkts bytes target prot opt in out source destination

(2)动态IP

[root@Andy ~]# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

客户端测试

[root@Andy ~]# ping www.baidu.com //ping通说明NAT路由转发实验成功

PING www.a.shifen.com (180.149.132.151) 56(84) bytes of data.

64 bytes from 180.149.132.151: icmp_seq=1 ttl=127 time=11.3 ms

64 bytes from 180.149.132.151: icmp_seq=2 ttl=127 time=3.44 ms

64 bytes from 180.149.132.151: icmp_seq=3 ttl=127 time=4.69 ms

64 bytes from 180.149.132.151: icmp_seq=4 ttl=127 time=3.05 ms

--- www.a.shifen.com ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3371ms

rtt min/avg/max/mdev = 3.057/5.642/11.367/3.361 ms

Centos6.x配置NAT实现网络地址转换

一、网络拓扑结构

技术分享图片

二、实验环境

2.1、客户机端(PC1)

[root@appex ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@appex ~]# uname -r

2.6.32-431.el6.x86_64

[root@appex ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:0A:9E:EA

inet addr:10.0.0.101 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fe0a:9eea/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:350 errors:0 dropped:0 overruns:0 frame:0

TX packets:168 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:28635 (27.9 KiB) TX bytes:17098 (16.6 KiB)

2.2、NAT服务器( R1 )

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:10.0.0.100 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

eth1 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:8F

inet addr:172.16.1.100 Bcast:172.16.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed8f/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2 errors:0 dropped:0 overruns:0 frame:0

TX packets:10 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:684 (684.0 b) TX bytes:636 (636.0 b)

2.3、NAT服务器( R2 )

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:172.16.1.10 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

eth1 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:8F

inet addr:172.16.2.3 Bcast:172.16.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed8f/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:2 errors:0 dropped:0 overruns:0 frame:0

TX packets:10 errors:0 dropped:0 overruns:0 carrier:0

2.4、客户机端(PC2)

[root@Andy ~]# cat /etc/redhat-release

CentOS release 6.5 (Final)

[root@Andy ~]# uname -r

2.6.32-431.el6.x86_64

[root@Andy ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:E4:ED:85

inet addr:172.16.2.100 Bcast:10.0.0.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fee4:ed85/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:89 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:9993 (9.7 KiB) TX bytes:9848 (9.6 KiB)

三、服务配置

3.1、客户端配置(PC1)

[root@appex ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=10.0.0.101

NETMASK=255.255.255.0

DNS2=223.5.5.5

GATEWAY=10.0.0.2

DNS1=10.0.0.2

IPV6INIT=no

USERCTL=no

3.2、NAT服务器配置( R1 )

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=10.0.0.100

NETMASK=255.255.255.0

GATEWAY=10.0.0.2 //配好网关，否则无法上网(在虚拟机的网络编辑器能找到网关)

DNS1=10.0.0.2

DNS2=223.5.5.5

IPV6INIT=no

USERCTL=no

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1(无网关)

DEVICE=eth1

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.1.100

NETMASK=255.255.255.0

IPV6INIT=no

USERCTL=no

3.3、NAT服务器配置( R2 )

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.1.10

NETMASK=255.255.255.0

GATEWAY=172.16.1.100

IPV6INIT=no

USERCTL=no

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth1(无网关)

DEVICE=eth1

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.2.3

NETMASK=255.255.255.0

IPV6INIT=no

USERCTL=no

3.4、客户端配置(PC2)

[root@Andy ~]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

TYPE=Ethernet

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=none

IPADDR=172.16.2.100

NETMASK=255.255.255.0

GATEWAY=172.16.2.3

IPV6INIT=no

USERCTL=no

四、NAT服务器配置及检测

4.1、配置前在客户机(PC1)检测(此时ttl值为64)

[root@appex ~]# ping 10.0.0.100

PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.

64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=5.43 ms

64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.417 ms

64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.425 ms

--- 10.0.0.100 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2261ms

rtt min/avg/max/mdev = 0.417/2.092/5.435/2.363 ms

4.2、外网NAT服务器(R1)

[root@Andy ~]# iptables -t nat -I PREROUTING -d 10.0.0.100/32 -i eth0 -j DNAT --to 172.16.2.100

[root@Andy ~]# iptables -t nat -L -nv

Chain PREROUTING (policy ACCEPT 15 packets, 2560 bytes)

pkts bytes target prot opt in out source destination

1 84 DNAT all -- eth0 * 0.0.0.0/0 10.0.0.100 to:172.16.2.100

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

209 14349 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 5 packets, 343 bytes)

pkts bytes target prot opt in out source destination

4.3、配置前在客户机(PC1)检测(此时ttl值发生变化)

[root@appex ~]# ping 10.0.0.100

PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.

64 bytes from 10.0.0.100: icmp_seq=1 ttl=127 time=5.51 ms

64 bytes from 10.0.0.100: icmp_seq=2 ttl=127 time=1.29 ms

64 bytes from 10.0.0.100: icmp_seq=3 ttl=127 time=1.29 ms

--- 10.0.0.100 ping statistics ---

7 packets transmitted, 7 received, 0% packet loss, time 6817ms

rtt min/avg/max/mdev = 1.113/1.837/5.512/1.502 ms

总结：

网络防火墙 eth0：外网网卡

内防外：

动态IP：iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

静态IP：iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.0/24 -j SNAT --to-source 202.10.19.1

外访内：

iptables -t nat -A PREROUTING -i eth0 -d 202.10.19.1 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.10

iptables之SNAT与DNAT

原文：http://blog.51cto.com/13162375/2103512

踩

(0)

评论一句话评论（0）

分享档案

更多>

2021年09月23日 (328)
2021年09月24日 (313)
2021年09月17日 (191)
2021年09月15日 (369)
2021年09月16日 (411)
2021年09月13日 (439)
2021年09月11日 (398)
2021年09月12日 (393)
2021年09月10日 (160)
2021年09月08日 (222)