Iptables/nat mode for Server Load balancer, iptablesnat

Iptables/nat mode for Server Load balancer, iptablesnat

The combination of Iptables and NAT can also achieve simple load balancing.

Introduction

The predecessor of iptables is ipfirewall (kernel 1. x era). This is a simple access control tool that the author transplanted from freeBSD and can work in the kernel to detect data packets. However, ipfirewall has extremely limited functions (it needs to put all the rules into the kernel so that the rules can run and put them into the kernel, which is generally extremely difficult ). When the kernel develops to 2. in the x Series, the software changed its name to ipchains. It can define multiple rules and concatenate them to work together. Now, it is called iptables, which can form a list of rules, implement absolutely detailed access control.

This tool is mainly used in the firewall. I only have a superficial understanding of the firewall. Here I mainly want to use iptables for simple load balancing.

 

Only allow external networks to establish connections with port 80 of the server over TCP

Iptables-F INPUT

Iptables-a input-I eth0-p tcp-dport80-j ACCEPT

Iptables-P INPUT DROP

 

Small applications

If we allow ourselves to ping others, but others cannot ping ourselves, how can we achieve this?

Analysis: For the ping protocol, the incoming value is 8 (ping), and the outgoing value is 0 (response). To achieve this goal, we need to exit 8 and allow the incoming value 0.

 

On the outgoing port: iptables-a output-p icmp -- icmp-type 8-j ACCEPT

On the incoming port: iptables-a input-picmp -- icmp-type 0-j ACCEPT

 

Small Extension: For 127.0.0.1, we need to clearly define it

Iptables-AINPUT-s 127.0.0.1-d 127.0.0.1-j ACCEPT

Iptables-AOUTPUT-s 127.0.0.1-d 127.0.0.1-j ACCEPT

 

Implement local port redirection

Iptables-t nat-a predout ing-I eth0-p tcp-dport80-j REDIRECT -- to-port 8000

Transfer all requests from the external network to port 80 on the server to port 8000. It can hide the actual ports of some services, or quickly switch a port to another port service to improve the flexibility of port management.

Iptables Server Load balancer

First, enable the server to be allowed to forward data packets:

Echo 1>/proc/sys/net/ipv4/ip_forward

Then, execute the rules as the scheduler (Server Load balancer:

Iptables-t nat-a predouting-I eht0-p tcp-dport 8001-j DNAT-to-destination10.0.0.100: 80

Forward all requests collected from Port 8001 on the Internet Nic of the scheduler to port 80 of the server 10.0.0.114;

Similarly, continue to execute

Iptables-t nat-a predouting-I eht0-p tcp-dport 8002-j DNAT-to-destination10.0.0.101: 80

 

These two rules enter the netfilter filter table, which can be viewed using the iptables command.

We have created a forwarding rule so that data packets can be forwarded. However, if there is only one more step back from the data, you must set the default gateway of the actual server as a NAT server. That is to say, the NAT server must be the actual Server Gateway.

Add a default gateway to the server:

Route add default gw 10.0.0.50

10.0.0.50 is the address of the NAT server.

Defects

This type of Server Load balancer seems simple, but it does not have the scheduling capabilities and scheduling policies that the scheduler should have. If you have a choice, I should stop using it.

 

Iptables rules

Format: iptables [-t table] COMMAND chain CRETIRIA-j ACTION

-T table: three filters nat mangle

COMMAND: defines how to manage rules

Chain: Specifies the chain on which your next rule is operated. when defining a policy, it can be omitted.

CRETIRIA: Specify matching criteria

-J ACTION: Specifies how to process

 

Filters can only be performed on three chains: INPUT, FORWARD, and OUTPUT.

Nat can only be implemented on three links: PREROUTING, OUTPUT, and POSTROUTING.

Mangle can be used in five chains: PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING.

 

Command description of Iptables

1. Chain management commands (these commands take effect immediately)

-P: Set the Default policy (set whether the default door is closed or open)

There are generally only two default policies.

Iptables-p input (DROP | ACCEPT) is disabled by default/is enabled by default

For example:

Iptables-p input drop rejects the default rule. No action is defined. Therefore, all rules for external connections, such as Xshell connections, are rejected.

-F: FLASH, clear the rule chain (pay attention to the management permission of each chain)

Iptables-t nat-F PREROUTING

Iptables-t nat-F clear all links in the nat table

-N: NEW supports creating a chain.

Iptables-Ninbound_tcp_web indicates that the web is checked on the tcp table.

-X: Used to delete custom empty chains.

The method is the same as-N, but you must clear the chain before deleting it.

-E: the Rename chain is mainly used to Rename the custom chain.

-E oldname newname

-Z: clears the chain and the counter of the default rule in the chain (there are two counters, how many packets are matched and how many bytes are matched)

Iptables-Z: Clear

 

2. Rule management commands

-A: append. Add A rule at the end of the current chain.

-I num: insert the number of the current rule.

-I 3: insert the third entry

-R num: Replays replacement/modification rules

Format: iptables-R 3 ............

-D num: delete. specify the number of rules to be deleted.

3. view the management command "-L"

Additional sub-commands

-N: the ip address is displayed in numbers. The ip address is displayed directly. If-n is not added, the ip address is resolved to the host name.

-V: displays details.

-Vv

-Vvv: more details

-X: displays the exact value on the counter, not in unit conversion.

-- Line-numbers: displays the row number of the rule.

-T nat: displays information about all levels.

When the request is rejected, only ESTABLISHED is allowed. when the request is rejected, only ESTABLISHED is allowed. Reject all default rules

Iptables-L-n -- line-number: Check the row where the previous rule is located

Rewrite INPUT

Iptables-r input 2-s172.16.0.0/16-d 172.16.100.1-p tcp -- dport 22-m state -- stateNEW, ESTABLISHED-j ACCEPT

Iptables-r output 1-mstate -- state ESTABLISHED-j ACCEPT