Iptables port ing and vsftp Security check 425 Security solution, iptablesvsftp

Iptables port ing and vsftp Security check 425 Security solution, iptablesvsftp

128.30.14.221 is a public IP address, 128.30.14.233 is a private IP address, and a normal Web server is set up on 233. Objective: To open a WEB port 88 on 221 and map it to 80 on 233

------- Ing Web port ------

service iptables stopiptables -Xecho 1 >/proc/sys/net/ipv4/ip_forward/sbin/modprobe iptable_natiptables -t nat -A PREROUTING -d 128.30.14.221 -p tcp -m tcp --dport 88 -j DNAT --to-destination 128.30.14.233:80iptables -t nat -A POSTROUTING -d 128.30.14.233 -p tcp --dport 80 -j MASQUERADEservice iptables saveservice iptables start

Open the browser and enter http: // 128.30.14.221: 88. The webpage is displayed normally.

-------- Ing Ftp port -------

128.30.14.221 is a public IP address, 128.30.14.233 is a private IP address, and a normal Ftp server is set up on 233. Objective: To open a port 88 on 221 and map it to port 21 on 233.

Run script on 221:

service iptables stopiptables -Xecho 1 >/proc/sys/net/ipv4/ip_forward/sbin/modprobe iptable_natiptables -t nat -A PREROUTING -d 128.30.14.221 -p tcp -m tcp --dport 88 -j DNAT --to-destination 128.30.14.233:21iptables -t nat -A POSTROUTING -d 128.30.14.233 -p tcp --dport 21 -j MASQUERADEservice iptables saveservice iptables start

When ftp or CuteFtp is connected to 128.30.14.221: 88, remember to use PASV passive mode, but still encounter 425 Security error. At this time, you need to run the script on the 233 Server:

/Sbin/modprobe ip_conntrack_ftp
/Sbin/modprobe ip_nat_ftp

Try again. Everything is normal.

How to Use IPTABLES to configure port ing?

Copied. Hope to help you
To implement iptables port ing, follow these steps:
I. Environment and functions to be implemented
The network settings of PC1 are as follows:
Eth0 192.168.0.29 Intranet
Eth1 219.239.11.22 Internet
The Network Setting of PC2 is 192.168.0.21 intranet.
The function we need to implement is to map port 8080 of PC1 to port 80 of PC2, that is, access
219.239.11.22: 8080
You can access the WEB service on pc2.
II. Implementation steps
1. First, the net. ipv4.ip _ forward = 1 in the/etc/sysctl. conf configuration file is 0 by default.
This allows iptalbes FORWARD.
2. There is an iptables file in the/etc/rc. d/init. d directory. The format is as follows:
Usage:./iptables {start | stop | restart | condrestart | status | panic | save}
Equivalent to service iptables {....}
Stop the iptables service, clear previous rules, and save disks.
Go to the/etc/rc. d/init. d directory and run
./Iptables stop
Iptalbes-F
Iptalbes-X
Iptalbes-Z
./Iptables save
3. reconfigure rules
Iptables-t nat-a prerouting-d 219.239.11.22-p tcp-m tcp -- dport 8080-j
DNAT -- to-destination 192.168.0.21: 80
Iptables-t nat-a postrouting-d 192.168.0.21-p tcp-m tcp -- dport 80-j SNAT
-- To-source 192.168.0.29
Iptables-a forward-o eth0-d 192.168.0.21-p tcp-dport 80-j ACCEPT
Iptables-a forward-I eth0-s 192.168.0.21-p tcp-sport 80-j ACCEPT
For more information about dnat snat, see help.
4. New rule Disks
./Iptables save
The rules are stored in the/etc/sysconfig/iptables file. If you are familiar with this file
Directly modifying the content here is also equivalent to entering the rule using the command line method.
5. Start the iptables service.
./Iptables start
There is a package flow in the/proc/net/ip_conntrack file, as shown below
Tcp 6 53 TIME_WAIT src =.../221.122.59.2 dst = 219.239.11.22 sport = 7958
Dport = 8080 packets = 9 bytes = 1753
Src =.../172.18.10.205 dst = 172.18.10.212 sport = 80 dport = 7958 packets = 9
Bytes = 5777 [ASSURED] use = 1 ...... the remaining full text>
 
How to configure port ing using iptables in Linux

No redirection end
Iptables-t nat-a prerouting-d XXX. XXX-p tcp -- dport 8767-j dnat -- to 192.168.1.3 :??