Linux之iptables(四、网络防火墙及NAT)

网络防火墙

iptables/netfilter网络防火墙：
(1) 充当网关
(2) 使用filter表的FORWARD链
注意的问题：
(1) 请求-响应报文均会经由FORWARD链，要注意规则的方向性
(2) 如果要启用conntrack机制，建议将双方向的状态为ESTABLISHED的报文直接放行

NAT

NAT: network address translation
PREROUTING，INPUT，OUTPUT，POSTROUTING
请求报文：修改源/目标IP，由定义如何修改
响应报文：修改源/目标IP，根据跟踪机制自动实现
SNAT：source NAT POSTROUTING, INPUT
让本地网络中的主机通过某一特定地址访问外部网络，实现地址伪装
请求报文：修改源IP
DNAT：destination NAT PREROUTING , OUTPUT
把本地网络中的主机上的某服务开放给外部网络访问(发布服务和端口映射)，但隐藏真实IP
请求报文：修改目标IP
PNAT: port nat，端口和IP都进行修改

SNAT

nat表的target：
SNAT：固定IP
--to-source [ipaddr[-ipaddr]][:port[-port]]
--random
iptables -t nat -A POSTROUTING -s LocalNET ! -d LocalNet -j SNAT --to-source ExtIP

[root@centos7a ~]#iptables -t nat -A POSTROUTING -s 10.0.1.0/ ! -d 10.0.1.0/ -j SNAT --to-source 172.16.32.6-172.16.32.10

[root@centos7a ~]#iptables -nvL -t nat

Chain PREROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination

          SNAT       all  --  *      *       10.0.1.0/         !10.0.1.0/          to:172.20.71.105-172.20.71.110

SNAT

MASQUERADE：动态IP，如拨号网络
--to-ports port[-port]
--random
iptables -t nat -A POSTROUTING -s LocalNET ! -d LocalNet -j MASQUERADE

[root@centos7a ~]#iptables -t nat -I POSTROUTING -s 10.0.1.0/ ! -d  10.0.1.0/ -j MASQUERADE

[root@centos7a ~]#iptables -nvL -t nat

Chain PREROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination

          MASQUERADE  all  --  *      *       10.0.1.0/         !10.0.1.0/

DNAT

--to-destination [ipaddr[-ipaddr]][:port[-port]]
iptables -t nat -A PREROUTING -d ExtIP -p tcp|udp --dport PORT -j DNAT --to-destination InterSeverIP[:PORT]

[root@centos7a ~]#iptables -t nat -A PREROUTING -s / -d 172.16.32.6 -p tcp --dport  -j DNAT --to-destination 10.0.1.22

[root@centos7a ~]#iptables -nvL -t nat

Chain PREROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination

          DNAT       tcp  --  *      *       0.0.0.0/            172.32.20.6          tcp dpt: to:10.0.1.22

[root@centos7a ~]#iptables -t nat -A PREROUTING -s / -d 172.16.32.6 -p tcp --dport  -j DNAT --to-destination 10.0.1.22:

[root@centos7a ~]#iptables -nvL -t nat

Chain PREROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination

          DNAT       tcp  --  *      *       0.0.0.0/            172.18.100.6         tcp dpt: to:10.0.1.22:

PNAT：利用虚拟端口进行数据转发

REDIRECT：
NAT表
可用于：PREROUTING OUTPUT 自定义链
通过改变目标IP和端口，将接受的包转发至不同端口
--to-ports port[-port]

[root@centos7a ~]#iptables -t nat -A PREROUTING -d 172.16.32.6 -p tcp --dport  -j REDIRECT --to-ports

[root@centos7a ~]#iptables -nvL -t nat

Chain PREROUTING (policy ACCEPT  packets,  bytes)

 pkts bytes target     prot opt in     out     source               destination

          REDIRECT   tcp  --  *      *       0.0.0.0/            172.16.100.10        tcp dpt: redir ports

巴特西

Linux之iptables(四、网络防火墙及NAT)

最新文章

热门文章