Linux with Iptables to do native port forwarding method __linux

One: Forwarding from one computer to another port
Enable the network card forwarding feature
#echo 1 >/proc/sys/net/ipv4/ip_forward

Example: Access to 192.168.0.211:1521 Port from 192.168.0.132:21521 (new port)

A. Forwarding at the same end of the port (192.168.0.132 1521 port access iptables-a rh-firewall-1-input-m State--state new-m tcp-p TCP--dport 1521-j ACCEPT)

Iptables-t nat-i prerouting-p tcp--dport 1521-j dnat--to
Iptables-t nat-i postrouting-p TCP--dport 1521-j Masquerade

B. Forwarding on different ports (192.168.0.132 21521 port access iptables-a rh-firewall-1-input-m State--state new-m tcp-p TCP--dport 21521-j ACCEPT)

Iptables-t nat-a prerouting-p tcp-m tcp--dport21521 -j dnat--to-destination 192.168.0.211:1521
Iptables-t nat-a postrouting-s 192.168.0.0/16-d 192.168.0.211-p tcp-m tcp--dport 1521-j SNAT--to-source .132


Above two equivalent configurations (simpler [specify network adapters]):
Iptables-t nat-a prerouting-p tcp-i eth0--dport 31521-j dnat--to 192.168.0.211:1521
Iptables-t nat-a Postrouting-j Masquerade


Save Iptables
#service iptables Save
#service iptables Restart

two uses iptables to do the native port forwarding code as follows:
Iptables-t nat-a prerouting-p tcp--dport 80-j REDIRECT--to-ports 8080


Estimating the appropriate addition of other parameters can also be done with different IP port forwarding.


If you need this machine to also be able to access, you need to configure the output chain (******** Special Note: Local access to the extranet port will be forwarded locally, resulting in the visit to the extranet, such as access to yown.com, is actually access to local, it is recommended not to do 80-port forwarding or specified purpose D localhost):

Iptables-t nat-a output-d localhost-p tcp--dport 80-j REDIRECT--to-ports 8080

Reason:
The extranet access needs to go through the prerouting chain, but the localhost does not go through the chain, so it needs to be output.

#######################################################################################

Overview: The company has a number of core MySQL server in the core of the internal network segment, as operational personnel, often need to connect these servers, because it can not directly through the extranet access to management caused inconvenience.

Thinking: Although there are many ways and ideas to solve this problem, but now want to use Iptables port redirection function to solve this problem, more simple and easy-to-use, but also relatively good scalability, and so on, can be applied to other port forwarding applications.
Network environment:
Public network server: eth0: Public network IP eth1: Intranet IP-192.168.1.1
MySQL server: eth1: Intranet IP-192.168.1.2
Implementation method: Through access to the public network IP 63306 port to achieve the intranet MySQL server 3306 port access
On the public network server:
Configuration script:
Iptables-t nat-a prerouting-p tcp--dport 63306-j dnat--to-destination
Iptables-t nat-a postrouting-d 192.168.1.2-p tcp--dport 3306-j SNAT--to 192.168.1.1

Allow server IP Forwarding capabilities:

Echo 1 >/proc/sys/net/ipv4/ip_forward
How to use:
Mysql-h Public network Ip-p 63306-uroot-p

###############################################################################################

As a result of business needs, more and more servers, intranet server without external network environment management is very inconvenient, so toss out the extranet to the intranet port forwarding to achieve easy management purposes, paste the experience.


S1:
Eth0 10.0.0.1
Eth1 x.x.x.x


S2:
Eth0 10.0.0.2


S1 8082 Port forward to intranet machine 22 port

The iptables rule is configured as follows:

Iptables-t nat-a prerouting-d x.x.x.x-p tcp--dport 8082-j dnat--to-destination 10.0.0.2:22

Iptables-t nat-a postrouting-d 10.0.0.2-p tcp--dport 22-j SNAT--to-source x.x.x.x

Description
Iptables-t nat-a prerouting-d "External public network IP"-P-TCP--dport "External port"-j dnat "Internal IP that actually provides service": "The port that actually provides the service"

Iptables-t nat-a postrouting-d "The actual service-provided IP"-P---dport "the port that actually provides the service"-j SNAT--to-source "Running the intranet IP of the iptables machine"