Detailed steps for port ing on Linux

Iptables port forwarding process
We have a computer with two NICs. eth0 is connected to the Internet, and the IP address is 1.2.3.4. eth1 is connected to the Intranet, and the IP address is 192.168.0.1. now, you need to forward the IP packet sent to port 81 of the address 1.2.3.4 to port 8180 of the IP address 192.168.0.2. The settings are as follows:

1. iptables-T Nat-A prerouting-D 1.2.3.4-p tcp-m tcp -- dport 81-j dnat -- to-destination192.168.0.2: 8180

2. iptables-T Nat-A postrouting-s 192.168.0.0/255.255.0.0-D 192.168.0.2-p tcp-m tcp -- dport 8180-j snat -- to-source 192.168.0.1

The actual transmission process is as follows:
Assume that the IP address of a client is 6.7.8.9. It uses port 1080 of the Local Machine to connect to port 81 of port 1.2.3.4. The source IP address of the sent IP package is 6.7.8.9, the source port is 1080, And the destination address is 1.2.3.4, the destination port is 81.

After the host 1.2.3.4 receives the packet, change the destination address of the IP packet to 192.168.0.2 and the destination port to 8180 according to the first rule in the NAT table, at the same time, create an entry in the connection trace table (which can be seen in the/proc/NET/ip_conntrack file), and then send it to the routing module to query the route table, confirm that the IP package should be sent to the eth1 interface. before sending the IP packet to the eth1 interface, according to the second rule in the NAT table, if the IP packet comes from the same subnet, the source address of the IP packet is changed to 192.168.0.1, update the corresponding entries in the connection trace table and send them to the eth1 interface.

In this case, there is an item in the connection tracking table:

Connection entry: src = 6.7.8.9 DST = 1.2.3.4 sport = 1080 dport = 81
Connection return: src = 192.168.0.2 DST = 6.7.8.9 sport = 8180 dport = 1080
Use or not: Use = 1

For an IP packet sent back from 192.168.0.2, the source port is 8180, the destination address is 6.7.8.9, And the destination port is 1080. After the TCP/IP stack of host 1.2.3.4 receives the IP packet, check whether the connection return column in The Connection Tracking table matches the same source and destination addresses and ports, change the source address of the IP package from 192.168.0.2 to 1.2.3.4 and the source port from 8180 to 81 Based on the record in the entry, and keep the destination port 1080 unchanged. in this way, the server's return packet can correctly return the client initiating the connection, and the communication starts like this.

Also, in the filter table, port 8180 of 192.168.0.2 address should be allowed to be connected from eth0:
Iptables-A input-D 192.168.0.2-p tcp-m tcp -- dport 8180-I eth0-J accept

I have searched a lot on the Internet and configured port ing in Linux. I configured port ing with iptables on redhat8.0 to describe the detailed configuration process for your reference.

STEP/Method

1. First, the net. ipv4.ip _ forward = 1 in the/etc/sysctl. conf configuration file is 0 by default.
   This allows iptalbes forward.
2. The iptables file is in the/etc/rc. d/init. d directory. The format is as follows:
   Usage:./iptables {START | stop | restart | condrestart | status | panic | save}
   Equivalent to service iptables {....}
   Stop the iptables service, clear previous rules, and save disks.
   Go to the/etc/rc. d/init. d directory and run
   ./Iptables stop
   Iptalbes-F
   Iptalbes-x
   Iptalbes-z
   ./Iptables save
3. Reconfigure rules
   Iptables-T Nat-A prerouting-D 219.239.xx.xx-p tcp -- dport 8080-j dnat -- to-destination 172.18.10.205: 80
   Iptables-T Nat-A postrouting-D 172.18.10.205-p tcp -- dport 80-j snat -- To 172.18.10.212
   Iptables-a forward-O eth0-D 172.18.10.205-p tcp -- dport 80-J accept
   Iptables-a forward-I eth0-s 172.18.10.205-P TCP -- Sport 80-J accept
   For more information about dnat snat, see help.
4. New rule Storage
   ./Iptables save
   The rules are stored in the/etc/sysconfig/iptables file. If you are familiar with this file
   Directly modifying the content here is also equivalent to entering the rule using the command line method.
5. Start the iptables service
   ./Iptables start
   There is a package flow in the/proc/NET/ip_conntrack file, as shown below
   TCP 6 53 time_wait src = 221.122.59.2 DST = 219.239.xx.xx sport = 7958 dport = 8080 packets = 9 bytes = 1753
   Src = 172.18.10.205 DST = 172.18.10.212 sport = 80 dport = 7958 packets = 9 bytes = 5777 [assured] Use = 1

UseUbuntu iptablesThere are many places for operation, such:IntranetPort ing

1. System Environment

Two servers on the Intranet:

A 172.16.119.128

B 172.16.119.129

You want to map port 80 of machine A to port 8013 of machine B.

　2. Setup steps

2.1./etc/sysctl. conf configuration file modification

Delete "#" in front of "# net. ipv4.ip _ forward = 1". This row is commented out by default.

2. view existing configuration information

Iptables-l

If the content is as follows:

Chain input (Policy accept)

Target prot opt source destination

Chain forward (Policy accept)

Target prot opt source destination

Chain output (Policy accept)

Target prot opt source destination

Indicates that no settings are set. You can continue the next step.

Otherwise, run:

Iptalbes-F

Iptalbes-x

Iptalbes-z

2. 3. Set port ing

Execute:

Iptables-T Nat-A prerouting-D 172.16.119.128-p tcp -- dport 80-j dnat -- to-destination 172.16.119.129: 8013

Iptables-T Nat-A postrouting-D 172.16.119.129-p tcp -- dport 8013-j snat -- To 172.16.119.128

Iptables-a forward-O eth0-D 172.16.119.129-p tcp -- dport 8013-J accept

Iptables-a forward-I eth0-s 172.16.119.129-P TCP -- Sport 8013-J accept

2. 4. Verify port ing

In this case, access http: // 172.16.119.128/abc.htmand access the abc.htm page corresponding to the 8013network port on the 129server.

3. Set to automatically load the iptables configuration file at startup

3.1 save Configuration

Run the following command:

# Iptables-save>/etc/init. d/iptables. Up. Rules

Save the current configuration to the iptables. Up. Rules file. The file name can be determined by yourself.

3.2 modify the NIC configuration file

Add the IP address of the network adapter to the last line of the/etc/Network/interfaces configuration file (/etc/init. d/iptables. Up. Rules can be changed to its own configuration file location and name)

Pre-up iptables-Restore </etc/init. d/iptables. Up. Rules

3.3 restart server Verification

Shutdown-R now

By introducing the three major steps in the text, we know how to set up the Intranet port ing of ubuntu iptables! Hope it will be useful to you!

Test: Ping www. Baidu. com from the laptop IP address 192.168.1.2