Iptables nat Experiment

IptablesOfNatThe experiment process is as follows:

1. Requirements:

1. Set iptables to make it a gateway and use the NAT proxy to access the internet on the LAN client;

2. Allow LAN clients to access the Internet from 192.168.1.2-100

2. Basic Topology

3. system and software environment:

1. Operating System: Red Hat Enterprise Linux AS release 4 (Nahant Update 2)

2. Required rpm software packages:

Iptables-1.2.11-3.1.RHEL4

Iptables-ipv6-1.2.11-3.1.RHEL4

Iptables-devel-1.2.11-3.1.RHEL4

4. required setting file or command:

/Sbin/iptables

5. Test procedure:

Note: All of the following operations are performed on the server (192.168.1.1 ).

1. Use vi to write the following script

[Root @ gdlc ~] # Vi fw. sh

#! /Bin/bash

# Set up a default search path.

PATH = "/sbin:/usr/sbin:/bin:/usr/X11R6/bin"

Export PATH

# Source function library.

./Etc/rc. d/init. d/functions

EPT = "/sbin/iptables"

Localnet = "192.168.1.0/24"

Ctlip = "192.168.1 ."

Startip = 2

Endip = 1, 100

Upnic = "eth1"

Downnic = "eth0"

Nat_func (){

/Sbin/modprobe ip_tables

/Sbin/modprobe ip_conntrack_ftp

/Sbin/modprobe ip_nat_ftp

Echo 1>/proc/sys/net/ipv4/ip_forward

$ Ipt-f-t filter

$ Ipt-f-t nat

$ Ipt-f-t mangle

### Ip masquerade #############

$ Ipt-a FORWARD-I $ Upnic-m state -- state ESTABLISHED, RELATED-j ACCEPT

$ Ipt-t nat-a postrouting-o $ Upnic-s $ localnet-j MASQUERADE

### Forward contrl ############

Declare n1 = $ startip

Declare n2 = $ endip

For (I = n1; I-a forward-s $ ctlip $ I-j ACCEPT; done

$ Ipt-a FORWARD-j DROP

}

Stop (){

Echo 0>/proc/sys/net/ipv4/ip_forward

$ Ipt-f-t filter

$ Ipt-f-t nat

$ Ipt-f-t mangle

}

Status (){

$ Ipt-n-L

}

# See how we were called.

Case "$1" in

Start)

Nat_func & echo "IPNAT start: 'echo _ success '"

;;

Stop)

Stop & echo "IPNAT stop: 'echo _ success '"

;;

Status)

Status

;;

*)

Echo $ "Usage: $0 {start | stop | status }"

Exit 1

;;

Esac

2. Run the script

[Root @ gdlc ~] # Sh fw. sh start

IPNAT start: [OK]

[Root @ gdlc ~] # Sh fw. sh stop

IPNAT stop: [OK]

Through the description of the first series of classes, we certainly know what the nat experiment process of iptables is like and hope it will be useful to everyone!