寻觅生命中的那一片浅草......

每日存档 六月 5th, 2009

iptables的SNAT和DNAT

SNAT和DNAT是通过NAT表实现的

SNAT:

将172.16.1.78转换成192.168.1.19
iptables -t nat -A POSTROUTING -s 172.16.1.78 -j SNAT –to-source 192.168.1.19

DNAT:

iptables -t nat -A PREROUTING -d 192.168.1.19 -p tcp -m tcp –dport 80 -j DNAT –to-destination 172.16.1.78

这样访问192.168.1.19的端口就会转发到172.16.1.78的80端口上,如果想转发到172.16.1.78的8080端口上,可以用如下命令

iptables -t nat -A PREROUTING -d 192.168.1.19 -p tcp -m tcp –dport 80 -j DNAT –to-destination 172.16.1.78:8080

当然还需要在filter里允许访问80,8080端口,当然,这里允许了对局域网所有主机80,8080端口的访问,为安全,应该进一步细化规则

iptables -A FORWARD -p tcp -m tcp –dport 80 -j ACCEPT

iptables -A FORWARD -p tcp -m tcp –dport 8080 -j ACCEPT

如何恢复iptables的默认设置

/usr/local/sbin/iptables -P INPUT ACCEPT
/usr/local/sbin/iptables -P FORWARD ACCEPT
/usr/local/sbin/iptables -P OUTPUT ACCEPT

#
# reset the default policies in the nat table.
#
/usr/local/sbin/iptables -t nat -P PREROUTING ACCEPT
/usr/local/sbin/iptables -t nat -P POSTROUTING ACCEPT
/usr/local/sbin/iptables -t nat -P OUTPUT ACCEPT

#
# flush all the rules in the filter and nat tables.
#
/usr/local/sbin/iptables -F
/usr/local/sbin/iptables -t nat -F

#
# erase all chains that’s not default in filter and nat table.
#
/usr/local/sbin/iptables -X
/usr/local/sbin/iptables -t nat -X’

转载自:http://www.7880.com/Info/Article-657b9d40.html

2009年六月
« 5月   7月 »
1234567
891011121314
15161718192021
22232425262728
2930