Enable kernel Routing and forwarding to allow intranet machines to surf the internet via Gnu/linux

Problem description

Intranet client machines access the Internet through a gnu/linux server. The Eth0 network card of the server can access the Internet, and eth1 network card is connected with intranet. The client wants to access the Internet through the server.

Experimental environment

Server:	Network card	IP	Subnet Mask	Gateway
Eth0	192.168.16.220	255.255.255.0	192.168.16.1
Eth1	192.168.15.222	255.255.255.0	192.168.15.1

Client:

Network card	IP	Subnet Mask	Gateway
Eth0	192.168.15.111	255.255.255.0	192.168.15.222

Server-to-client Configuration server-side configuration

View the routing table information on the server,

# route -nKernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Iface192.168.16.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0192.168.15.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth10.0.0.0         192.168.16.1    0.0.0.0         UG    0      0        0 eth0

Enables routing and forwarding of the server core with routing capabilities

# echo 1 > /proc/sys/net/ipv4/ip_forward# 或者使用下面的方式# sysctl -w net.ipv4.ip_forward=1# sysctl -p

/etc/sysctl.confIt is best to modify the configuration file to make its configuration permanent.

Configure NAT Rules

After the second part of the configuration, although the relevant IP address can be ping, but the intranet host is still unable to surf the internet. The problem is that the IP address of the intranet host cannot be routed on the public network. Therefore, the need to convert to Linux system host can be Internet IP (Note: Here we do not say is the public IP, is because the Linux system can directly Sisu network IP is also the intranet IP. However, the intranet IP (192.168.16.220) has been through some mechanisms, in fact, the same NAT way, can access the extranet, so we just need to convert the IP of host A to the Eth0 interface of the Linux system IP can be.

Here are the NAT rules we configured:

# iptables -t nat -A POSTROUTING -s 192.168.15.0/24 -o eth0 -j SNAT --to-source 192.168.16.220# iptables -A FORWARD -i eth1 -j ACCEPT

Configuration of the Client

The client's settings are relatively simple, the client's gateway IP address is the server intranet IP address, DNS and the server is the same.

Test

If the client can ping the pass-www.baidu.com, then the intranet can access the Internet.

Enable kernel Routing and forwarding to allow intranet machines to surf the internet via Gnu/linux