Application of Snat and Dnat strategy in Linux system

SNAT (source address translation) is an address translation operation of the Linux firewall and a type of packet in the iptables command that modifies the source IP address of the packet according to the specified conditions

DNAT (Destination address translation) is another address translation operation for the Linux firewall, which is a type of packet in the iptables command that modifies the destination IP address and destination port of the packet according to the specified conditions

Experimental environment: A Linux6.5 as an extranet Web server with an address of 12.0.0.12

A Linux6.5 as a firewall and internal and external network gateway, two addresses are 192.168.100.1; 12.0.0.1

A widows as an intranet client with an address of 192.168.100.4

1 before the Web server to set up, here need to clear the firewall entry rules inside, and to close Setenforce 0, to open its Web services

2 here in the local visit for a while no problem found

3 Next we want to configure this server as a firewall, where you need to add a dual network card, one as the gateway to the intranet, the other as a gateway to the extranet

4 then close the server's Setenforce, also empty its firewall rule entry, and need to turn on its route conversion function, because it as a gateway to the intranet, if not open the two machines can not

Mutual access

5 here with the intranet Win7 access to the external Web server, you can see the success of the visit

6 intranet can access the network after we start to do snat address translation, just need to complete the command in the red box.

This command, where-t NAT is the specified NAT table, needs to apply the rules in the table

-A postrouting is the rule chain that specifies the table

-s Specifies the source address to be converted

-O is the outbound network card, here my outbound network card is eth1

-j SNAT represents an address translation operation that performs SNAT

--to-source represents the converted Address

7 Here I visit the Web server again and can see that the address of the visitor is displayed in the log file as 12.0.0.1

8 then Dnat address translation, execute the command in the Red box, this command is similar to the Snat address translation command

Here-a prerouting is required to specify prerouting this rule

-I indicates an inbound network adapter

-P Specify protocol

-dport Specifying interfaces

--to-destination represents the converted Address

9 then we open the Intranet client's website service and then use the extranet Web server to access the converted Address

10 Finally, the network Web server to access the 12.0.0.1 address, you can see the Internet access to the site.

Application of Snat and Dnat strategy in Linux system