Problem description
Intranet client machines access the Internet through a gnu/linux server. The Eth0 network card of the server can access the Internet, and eth1 network card is connected with intranet. The client wants to access the Internet through the server.
Experimental environment
Server:
|
Network card |
IP |
Subnet Mask |
Gateway |
Eth0 |
192.168.16.220 |
255.255.255.0 |
192.168.16.1 |
Eth1 |
192.168.15.222 |
255.255.255.0 |
192.168.15.1 |
Client:
Network card |
IP |
Subnet Mask |
Gateway |
Eth0 |
192.168.15.111 |
255.255.255.0 |
192.168.15.222 |
Server-to-client Configuration server-side configuration
View the routing table information on the server,
# route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface192.168.16.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0192.168.15.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth10.0.0.0 192.168.16.1 0.0.0.0 UG 0 0 0 eth0
Enables routing and forwarding of the server core with routing capabilities
# echo 1 > /proc/sys/net/ipv4/ip_forward# 或者使用下面的方式# sysctl -w net.ipv4.ip_forward=1# sysctl -p
/etc/sysctl.conf
It is best to modify the configuration file to make its configuration permanent.
Configure NAT Rules
After the second part of the configuration, although the relevant IP address can be ping, but the intranet host is still unable to surf the internet. The problem is that the IP address of the intranet host cannot be routed on the public network. Therefore, the need to convert to Linux system host can be Internet IP (Note: Here we do not say is the public IP, is because the Linux system can directly Sisu network IP is also the intranet IP. However, the intranet IP (192.168.16.220) has been through some mechanisms, in fact, the same NAT way, can access the extranet, so we just need to convert the IP of host A to the Eth0 interface of the Linux system IP can be.
Here are the NAT rules we configured:
# iptables -t nat -A POSTROUTING -s 192.168.15.0/24 -o eth0 -j SNAT --to-source 192.168.16.220# iptables -A FORWARD -i eth1 -j ACCEPT
Configuration of the Client
The client's settings are relatively simple, the client's gateway IP address is the server intranet IP address, DNS and the server is the same.
Test
If the client can ping the pass-www.baidu.com, then the intranet can access the Internet.
Enable kernel Routing and forwarding to allow intranet machines to surf the internet via Gnu/linux