Simple implementation of iptables route forwarding and address disguise

Simple implementation of iptables route forwarding and address disguise

Three virtual machines simulate a Firewall Application
I. Three virtual machines A, B, and iptables are created on the Vmware software, which are used as client A, firewall routing iptables, and server B respectively.
Add an Eni eth1 to the route iptables and set the IP Address: 1.2.3.4/16, and the IP address of eth0 to 172.16.10.1/16.
A's IP-1.2.3.5/16
B's IP-172.16.10.2/16
Modify the configuration file of the machine iptables so that it can forward and act as a route.
Echo 1>/proc/sys/net/ipv4/ip_forward # This file cannot be edited and modified directly. You do not need to restart it after modification.
Test
After the configuration is complete, you can use the PING command to test whether A and iptables, B and iptables, And A and B can communicate with each other.

AB, A, iptables, B, and iptables can ping each other.
What we need to achieve is to hide the IP address of host A when A accesses host B. When machine B views the access log of its host, it will see the IP address of the iptables machine. How is it? It's amazing. Let's take a look.
When you hear this, you may think of hiding your own IP address to do something you don't want others to know. Indeed, this is what iptables can do. Iptables can do more than this. The most important thing is to improve security.
The following are specific practices. If you are familiar with these practices, you can skip them.
Distribution of three machines:
Machine:
1. Change the NIC settings:


2. Modify the IP address
Vim/etc/sysconfig/network-scripts/ifcfg-eth0
IPADDR = 1.2.3.5 # modify the value of IPADDR
GATAWAY = 1.2.3.4 # the gateway of A is the IP address of eth1 of iptables.

Service network restart # restart the service to make the modification take effect
Iptables machine:
1. Change the NIC settings:


The configuration of the second Nic must be consistent with that of the NIC so that they are in the same CIDR block. If they are not set, the two cannot communicate with each other.



2. Modify the IP address
Vim/etc/sysconfig/network-scripts/ifcfg-eth0
IPADDR = 172.16.10.1 # modify the value of IPADDR

Vim/etc/sysconfig/network-scripts/ifcfg-eth1
IPADDR = 1.2.3.4 # modify the value of IPADDR

Vim/etc/sysconfig/network

Service network restart
The two NICs of iptables and machine A are completed. You can test whether the two Enis can ping each other.
Ping 1.2.3.5 # ping machine A on iptables
 


Ping 1.2.3.4 # ping the machine iptables on iptables


1. Change the NIC settings:
Change machine B to Vmnet2
2. Modify the IP address
Vim/etc/sysconfig/network-scripts/ifcfg-eth0
IPADDR = 172.16.10.2 # modify the value of IPADDR
GATAWAY = 172.16.10.1 # the gateway of B is the eth0 IP address of iptables.
Service network restart
II:
This method not only supports route forwarding. Yes
For example, if A accesses B, the IP address of the eth0 Nic of the machine iptables is displayed to B.
Iptables-t nat-a postrouting-o eth0 17216.10.1-j SNAT-to-source 172.16.10.2 # Add the following rules on the machine (iptables)
View the logs of B.
Ssh 172.16.10.2 # Check whether ssh can be connected
Ifconfig eth0 # Check the IP address to confirm the current host
You can use this simple command to convert IP addresses.