Linux Server--iptables Port forwarding

Daily Iptables Port forwarding

1. Requirements: The company is a local network, through an external network IP, Internet access. The company's cloud platform server in the public network, the virtualization platform has an internal server for the use of a company department, the above run WWW service, SSH port, convenient to upload website files. The current leadership requires this internal server to be handed over to this department, and only let it in the company's internal access, the outside public network is denied access.

Structure diagram:

2. Workaround: Through the Linux server iptables, the use of port forwarding, within the company through a machine (or a representative of a department), so that its access to the B machine on the specific connection to the internal machine C. Since the engine room server only opens a specific port, the 9090 port and 80 port of the B machine are forwarded to the 22 and 80 ports on the internal machine C, respectively.

Before modifying the firewall, you need to modify the system kernel to turn on the IPv4 forwarding function: Vim/etc/sysconfig, modify the following values Ipv4_net_forward = 1, and then run the SYSCTL-P command to take effect.

First back up the firewall configuration file, and then edit the firewall: Vim/etc/sysconfig/iptables, append the following rule (four rules for forwarding must be written in the NAT table):

*nat

:P rerouting ACCEPT [888,442:52,703,267]

:P ostrouting ACCEPT [712,676:42,810,839]

: OUTPUT ACCEPT [712,676:42,810,839]

-A prerouting-s 223.1.1.2-d 101.1.1.3-p tcp-m tcp--dport 9090-j DNAT--to-destination 10.8.88.88:22

Note: links from 223.1.1.2 and the destination is 101.1.1.3:9090 port forwarding to the 10.8.88.88:22 port

-A postrouting-d 10.8.88.88-p tcp-m tcp--dport 22-j SNAT--to-source 10.8.88.77

Note: The package of the loop, all packets returned from the 22 port of the internal machine C are forwarded to the eth1 NIC on the B machine

-A prerouting-s 223.1.1.2-d 101.1.1.3-p tcp-m tcp--dport 80-j DNAT--to-destination 10.8.88.88:80

Note: ditto

-A postrouting-d 10.8.88.88-p tcp-m tcp--dport 80-j SNAT--to-source 10.8.88.77

Note: ditto

*filter

-A input-s 223.1.1.2-p tcp-m tcp--dport 9090-j ACCEPT

-A input-s 223.1.1.2-p tcp-m tcp--dport 80-j ACCEPT

-A input-j REJECT--reject-with icmp-host-prohibited

3. After the modification is complete, save the configuration. Restart the Iptables service and you can test it now.

Linux Server--iptables Port forwarding