Easy handling of linux port forwarding

It's easy to handle port forwarding from one server to another. Enable Nic forwarding function # echo 1>/proc/sys/net/ipv4/ip_forward www.2cto.com. Example: From 192.168.0.132: 21521 (New Port) Access 192.168.0.211: port 1521
A. Same port forwarding (1521 port access is enabled on 192.168.0.132

Iptables-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 1521-j ACCEPT) iptables-t nat-I prerouting-p tcp -- dport 1521-j DNAT -- to 192.168.0.211iptables-t nat-I postrouting-p tcp -- dport 1521-j MASQUERADE B. different port forwarding (enable port 21521 on 192.168.0.132 to access iptables-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 21521-j ACCEPT) iptables-t nat-a prerouting-p tcp-m tcp -- dport 21521-j DNAT -- to-destination 192.168.0.211: 1521 iptables-t nat-a postrouting-s 192.168.0.0/16-d 192.168.0.211-p tcp-m tcp -- dport 1521-j SNAT -- to-source 192.168.0.132 and above two equivalent configurations (simpler [specify the NIC]):
Iptables-t nat-a prerouting-p tcp-I eth0 -- dport 31521-j DNAT -- to 192.168.0.211: 1521 iptables-t nat-a postrouting-j MASQUERADE save iptables # service iptables save # service iptables restart 2 Use iptables for local port forwarding www.2cto.com: iptables-t nat-a prerouting-p tcp -- dport 80-j REDIRECT -- to-ports 8080 it is estimated that adding other parameters can also be used for port forwarding of different IP addresses. If you want to access the local machine as well, you need to configure the OUTPUT chain (******** note: the port used to access the Internet from the local machine will be forwarded to the local machine, resulting in no access to the Internet, for example, access to yown.com is actually accessed to the local machine. We recommend that you do not forward port 80 or specify the destination-d localhost ):
Iptables-t nat-a output-d localhost-p tcp -- dport 80-j REDIRECT -- to-ports 8080 cause: Internet access needs to go through the PREROUTING chain, but localhost does not go through this chain, therefore, OUTPUT is required. Author yown