Linux firewall--iptables (iii)

Vii. Snat Source Address Translation

· Source Network Address Translation

• Modify the source address of the packet

• postrouting chains for NAT tables only

Example: LAN shared public network IP internet

• Key Policies for configuration

→ After the routing is done, the source IP address of the packet from the LAN and the outgoing interface is modified to

Gateway's public IP address

# iptables-t nat-a postrouting-s 192.168.1.0/24 -o eth1 -j SNAT--to-source 69.166.70.28

# LAN network segment address external network interface IP address

· Masquerade---address spoofing

→ The IP address of the external network interface is not fixed.

→ Change snat rule to Masquerade

→ for ADSL dial-up connection, the interface may be ppp+

# iptables-t nat-a postrouting-s 192.168.1.0/24-o eth1-j Masquerade

Viii. Destination Address Translation

· Destination Network Address Translation

• Modify the Packet del Destination address (IP, port)

• Prerouting, output chain only for NAT tables

Example: Publishing servers located in the intranet

• Key Policies for configuration

→ before routing, for packets received from the external network interface, access to the local public address tcp/udp XX Port of the packet, the target

Address is modified to the IP address of the corresponding host in the intranet

A. Publishing Web services

# iptables-t nat-a prerouting-i eth1-d 69.166.70.28 -P TCP--dport 80-j DNAT--to-destination 1 92.168.1.100

# The IP address of the extranet interface IP address intranet web host

B. Publish the SSH service

→ When performing ssh-p 3333 192.168.1.1, the actual SSH login 192.168.1.10

# iptables-t nat-a prerouting-i eth1-d 192.168.1.1-p tcp--dport 3333-j DNAT--to-destination 192.168.1.10: A

C. Publish FTP Service

→ to load modules nf_nat_ftp, NF_CONNTRACK_FTP

# iptables-t nat-a prerouting-i eth1-d 192.168.1.1-p tcp--dport 20:21-j DNAT--to-destination 192.168.1.10< /c3>

Nine, Firewall script application

• Firewall Rules Collation

→ Import and export rules

A. Export using Iptables-sace

# Iptables-save

# Generated by Iptables-save v1.4.7 on Sun Jul 13 11:31:34 2014

....

# completed on Sun Jul 13 11:31:34 2014

# iptables-save >/root/my_iptables.rule

B. Import using Iptables-restore

#iptables-restore </root/my_iptables.rule

C, automatically load the saved rules after boot
# iptables-save >/etc/sysconfig/iptables

Linux firewall--iptables (i) http://nmore.blog.51cto.com/9008175/1437118

Linux firewall--iptables (ii) http://nmore.blog.51cto.com/9008175/1437304

Linux firewall--iptables (iii) http://nmore.blog.51cto.com/9008175/1437540

This article is from the "Ywcto" blog, make sure to keep this source http://nmore.blog.51cto.com/9008175/1437540