Nat Foundation of Iptables

Nat
To enable network card forwarding:
Set the value of/proc/sys/net/ipv4_forward to 1, and the edit/etc/sysctl.conf is permanently active.

Note: The IP address of Linux belongs to the host instead of the network card, so the corresponding IP address of each NIC can communicate with each other internally.

Suppose there are IP1 IP2 corresponding gateways for GW1 GW2,GW1 and GW2 on a Linux.

If IP1 and IP2 are intranet, as long as the corresponding gateway set up, you can communicate with each other, do not need NAT.

NAT Session table: Records information about the source address, destination address, protocol port number, and so on for the relevant packet.

NAT completes the corresponding address translation through the NAT session table and Ip_conntrack.

SNAT
Source address translation, the destination address is not changed. It is applicable to intranet multiple computers to access external network resources through the external network address. The message is to complete the address translation (postrouting) when the gateway is out.

IP1 (intranet) access to IP2 (external network)

Send: Packet (IP1,IP2)--GW1 (Packet (IP1,IP2))-->gw2 (Packet (IP1,IP2))-->snat (Packet (GW2,IP2))--NAT Session table (build IP1 <-- > GW2)--GW2 (Packet (GW2,IP2))--and route selection--IP2 (Packet (GW2,IP2))

Response: Packet (IP2,GW2)--routing---GW2 (Packet (IP2,GW2))-->nat Session table (internal automatic Destination address translation)--GW2 (Packet (IP2,IP1))--GW1 (Packet (I P2,IP1)--IP1 (Packet (IP2,IP1))

DNAT
Destination address translation, the source address is not changed. It is suitable for extranet users to access multiple servers on the intranet through the Gateway's external network address. The message is to complete the address translation (prerouting) when it is just entering the gateway.

IP2 (external network) Access IP1 (intranet)

Send: Packet (IP2,GW2)--routing--GW2 (Packet (IP2,GW2))-->dnat (Packet (IP2,IP1)--NAT Session table (build GW2 <--> IP1)- GW2 (Packet (IP2,IP1))--GW1 (Packet (IP2,IP1)--IP1 (Packet (IP2,IP1))

Response: Packet (IP1,IP2)--GW1 (Packet (IP1,IP2))-->gw2 (Packet (IP1,IP2))--NAT Session table (internal automatic source address translation)--GW2 (Packet (GW2,IP2))-- > Route Selection--IP2 (Packet (GW2,IP2))

This article is from "Small Private blog" blog, please be sure to keep this source http://ggvylf.blog.51cto.com/784661/1663824

Nat Foundation of Iptables