Linux Source address translation (i)

Linux iptables Source Address conversion experiment

1. Environmental preparedness

Before the experiment I first prepared three Linux hosts, using the operating system is: CentOS, three hosts network planning as follows:

The first host: Intranet, analog intranet host, network connection mode using bridge connection, ip:192.168.10.2

Second host: Internet, simulated external network host, network connection mode using only host mode, ip:172.16.100.2

Third host: Iptables, analog route forwarding, which has two network cards, the first network card (EHT1) ip:192.168.10.1, the second network card (eth2) ip:172.16.100.1

2. Start the experiment

hosts on the same network can communicate with each other at this time, and can be verified with a ping command. If you want your intranet to access Iptables 172.16.10.1, you need to specify a gateway for your intranet and the Internet:

To specify a gateway for the intranet: route add default 192.168.10.1

To specify the gateway for the Internet: route add default 172.16.100.1

After you specify the gateway, you need to turn on the iptables forwarding feature:

Echo 1 >/proc/sys/net/ipv4/ip_forward is temporarily active, restarting the network service or failing the host.

vim/etc/sysctl.conf Net.ipv4.ip_forward = 1 can be modified, permanently valid.

The intranet can access the Internet host at this point, but the source address is intranet:192.168.10.2. For source address translation, firewall rules need to be added to the iptables host:

Iptables-t nat-a postrouting-s 192.168.10.0/24-o eth2-j SNAT--to-source 172.16.100.1

After the rule is added, the address of the packet from the intranet is converted to 172.16.100.1

This article is from the Shell Implementation Calculator blog, so be sure to keep this source http://codekong.blog.51cto.com/10704076/1739968

Linux Source address translation (i)