Article Title: Understanding classic Linux Firewall applications to make enterprise networks more secure. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
The iptables command is used to filter packets and perform NAT Network Address Translation (Network Address Translation) as seen in man queries. This command has many applications, many applications on the network can be implemented.
Iptables-administration tool for IPv4 packet filtering and NAT
Application 1: allow computers on the regional network to share bandwidth (NAT) with a real IP Address)
Architecture diagram:
Required devices: One Linux server and two network cards
Nic 1: eth0, use real IP address, Nic 2: eth1, use 192.168.1.254
Set: Write the following lines in/etc/rc. d/rc. local:
Echo "1">/proc/sys/net/ipv4/ip_forward
Modprobe ip_tables
Modprobe ip_nat_ftp
Modprobe ip_conntrack
Modprobe ip_conntrack_ftp
Iptables-t nat-a postrouting-o eth0-s 192.168.1.0/24-j MASQUERADE
Application 2: allow computers on the regional network to share bandwidth (NAT) with an ADSL)
This example is very similar to the previous example, but a certain setting must be modified.
Architecture diagram:
Required devices: One Linux server and two network cards
Nic 1: eth0, use real IP address, Nic 2: eth1, use 192.168.1.254
Set: Write the following lines in/etc/rc. d/rc. local:
Echo "1">/proc/sys/net/ipv4/ip_forward
Modprobe ip_tables
Modprobe ip_nat_ftp
Modprobe ip_conntrack
Modprobe ip_conntrack_ftp
Iptables-t nat-a postrouting-o ppp0-s 192.168.1.0/24-j MASQUERADE
Application 3: allow external computers to access a server in the region Network)
This method protects internal servers.
Architecture diagram:
Required devices: One Linux server and two network cards
Nic 1: eth0, use real IP address, Nic 2: eth1, use 192.168.1.254
Set: Write the following lines in/etc/rc. d/rc. local:
Echo "1">/proc/sys/net/ipv4/ip_forward
Modprobe ip_tables
Modprobe ip_nat_ftp
Modprobe ip_conntrack
Modprobe ip_conntrack_ftp
Iptables-t nat-a postrouting-o eth0-s 192.168.1.0/24-j MASQUERADE
Iptables-t nat-a prerouting-I eth0-p tcp-d real IP -- dport 80-j DNAT -- to-destination 192.168.1.13: 80