Iptables Network access control

Refer to But_bueatiful's blog: url: http://blog.chinaunix.net/uid-26495963-id-3279216.html

Iptables the rules into a list of absolutely detailed access control functions.

These five locations are also known as the five hook functions (hook functions), also called Five rule chains. 1.PREROUTING (before routing) 2.INPUT (packet inflow port) 3.FORWARD (forwarding pipe card) 4.OUTPUT (Packet exit) 5.POSTROUTING (after routing) This is the five rule chain of NetFilter, any one data Package, as long as the machine, will pass through the five chain in one of the chain.

1.SNAT conversion based on the original address

Based on the conversion of the original address is generally used in many of our intranet users through a network of the mouth of the Internet, when we will be the address of our intranet into an extranet IP, we can connect to other extranet IP functions.

The IP of all 192.168.10.0 segments is converted into 172.16.100.1 this hypothetical extranet address: iptables-t nat-a postrouting-s 192.168.10.0/24-j- To-source 172.16.100.1 this way, as long as it is from the local network to try to access the network through the NIC, will be converted into 172.16.100.1 this IP.

2.DNAT Destination Address translation

For destination address translation, the data flow is from the outward, outside is the client, inside is the server end through the target address conversion, we may let the outside IP through our external network IP to visit our server different server, but our service is placed in the intranet server's different server.
How to do the target address translation. : Iptables-t nat-a prerouting-d 192.168.10.18-p tcp--dport 80-j dnat--todestination The destination address translation to Before the NIC is converted, so do it in the prerouting position.

Iptables-t nat-a prerouting-p tcp--dport 80-j REDIRECT--to-ports 8180

Switch 80-Port route to 8180 Port

-T NAT: Displays information about all the checkpoints

-A: Append, add a rule at the end of the current chain

-P: For matching protocols (there are usually 3 of these protocols, TCP/UDP/ICMP

-P TCP:TCP extension of the protocol. There are generally three kinds of extended--dport xx-xx: Specify the destination port, not multiple noncontiguous ports, only single ports can be specified
-j action, where action can be redirect: Redirect: Primarily for port redirection