Linux firewall--iptables (iii)

Source: Internet
Author: User

Vii. Snat Source Address Translation

· Source Network Address Translation

• Modify the source address of the packet

• postrouting chains for NAT tables only


Example: LAN shared public network IP internet

• Key Policies for configuration

→ After the routing is done, the source IP address of the packet from the LAN and the outgoing interface is modified to

Gateway's public IP address

# iptables-t nat-a postrouting-s 192.168.1.0/24 -o eth1 -j SNAT--to-source 69.166.70.28

# LAN network segment address external network interface IP address


· Masquerade---address spoofing

→ The IP address of the external network interface is not fixed.

→ Change snat rule to Masquerade

→ for ADSL dial-up connection, the interface may be ppp+

# iptables-t nat-a postrouting-s 192.168.1.0/24-o eth1-j Masquerade


Viii. Destination Address Translation

· Destination Network Address Translation

• Modify the Packet del Destination address (IP, port)

• Prerouting, output chain only for NAT tables


Example: Publishing servers located in the intranet

• Key Policies for configuration

→ before routing, for packets received from the external network interface, access to the local public address tcp/udp XX Port of the packet, the target

Address is modified to the IP address of the corresponding host in the intranet


A. Publishing Web services

# iptables-t nat-a prerouting-i eth1-d 69.166.70.28 -P TCP--dport 80-j DNAT--to-destination 1 92.168.1.100

# The IP address of the extranet interface IP address intranet web host


B. Publish the SSH service

→ When performing ssh-p 3333 192.168.1.1, the actual SSH login 192.168.1.10

# iptables-t nat-a prerouting-i eth1-d 192.168.1.1-p tcp--dport 3333-j DNAT--to-destination 192.168.1.10: A


C. Publish FTP Service

→ to load modules nf_nat_ftp, NF_CONNTRACK_FTP

# iptables-t nat-a prerouting-i eth1-d 192.168.1.1-p tcp--dport 20:21-j DNAT--to-destination 192.168.1.10< /c3>


Nine, Firewall script application

• Firewall Rules Collation

→ Import and export rules

A. Export using Iptables-sace

# Iptables-save

# Generated by Iptables-save v1.4.7 on Sun Jul 13 11:31:34 2014

....

# completed on Sun Jul 13 11:31:34 2014

# iptables-save >/root/my_iptables.rule


B. Import using Iptables-restore

#iptables-restore </root/my_iptables.rule


C, automatically load the saved rules after boot
# iptables-save >/etc/sysconfig/iptables


Linux firewall--iptables (i) http://nmore.blog.51cto.com/9008175/1437118

Linux firewall--iptables (ii) http://nmore.blog.51cto.com/9008175/1437304

Linux firewall--iptables (iii) http://nmore.blog.51cto.com/9008175/1437540

This article is from the "Ywcto" blog, make sure to keep this source http://nmore.blog.51cto.com/9008175/1437540

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.