Iptablessnat and dnat

Snat and dnat in iptables are very useful. I think the two of them are quite special.

Snat and dnat in iptables are very useful. I think the two of them are quite special, so let's talk about them separately.

Dnat is used for destination network address translation, that is, to rewrite the destination IP address of the package. If a package matches, all packages that belong to the same stream will be automatically converted and then routed to the correct host or network. For example, your Web server is inside the LAN and there is no real IP address that can be used on the Internet, then we can use this dnat to allow the firewall to forward all packets sent to its own HTTP port to the real Web server in the LAN. The destination address can also be a range. in this way, DNAT will randomly allocate a machine for each request, so that we can use this dnat for load balancing.

[Root @ linux ~] # Iptables-t nat-a prerouting-I eth0-p tcp \
-- Dst 122.225.97.111 -- dport 80-j DNAT -- to-destination 192.168.1.130: 80

In the preceding example, all packets sent from the eth0 Nic to 122.225.97.111 are forwarded to the machine 192.168.1.130 on the LAN. It can also be configured with full-string functions.

[Root @ linux ~] # Iptables-t nat-a prerouting-I eth0-p tcp -- dport 80 \
-M string -- string "img.51yip.com" -- algo bm-j DNAT -- to-destination 192.168.1.136: 80

Transfer the request matching img.51yip.com to 192.168.1.136 on the LAN.

Snat can disguise local IP addresses as IP addresses of other machines or public IP addresses,
Suppose I have three machines, one of which can be connected to the Internet, and the other two are not. machines that cannot access the Internet can pretend to be the IP addresses of those machines that can access the Internet.

[Root @ linux ~] # Iptables-t nat-I POSTROUTING 1-j SNAT-s 192.168.10.0/24 -- to-destination 192.168.1.108

The IP address range 192.168.10.0/24 is not accessible, and the IP address range 108 is accessible.