"Linux system static Routing and Firewall Routing"

This article is mainly about the addition of static routing table, and how to let you do not have access to the Internet host through the Firewall routing table to achieve the function of the Internet.

Static route table:

If your host is 2 network card, and do a network card binding, according to my method below is not successful, you can go to edit:

# vim/etc/rc.d/rc.local

IP route add 12.0.0.1/24 via 192.168.1.113

Sh/etc/rc.d/rc.local//Do it all right

Let's look at the addition of the regular routing table:

The default routing table for my system,

Add a route table below: Such additions are only temporary.

View the following routing table:

When we restart Network Discovery the above additions are gone, now add permanent static routes: default This file is not there we need to create a new,

Add to that NIC the router that writes that Nic: Route-eth0 route-eth1 ...

Restart Network view:

To view the routing table:

Through the iptables firewall, so that can not access the Internet host to achieve the function of the Internet:

Test environment:

3 network segments can be connected to the Internet, ping the outside network

The host of the dual network card is 3 network segment, a piece is 4 network segment, can surf the net.

Single network card host bit 4 network segment, can not surf the Internet, open Apache function.

The following firewall strategy is written on the host of the dual NIC.

[Email protected] ~]# iptables-t nat-a postrouting-o eth0-j SNAT--to-source 192.168.3.113

callout: In Nat table Add Policy: All the packages that go out of the machine are converted into network segments that can be connected to the Internet, postrouting meaning after routing,-O out go out, SNAT . Source Address Translation eth0 can surf the internet eth1 Internet access is not available.

[Email protected] ~]# iptables-t nat-a prerouting-i eth0-p tcp--dport 80-j DNAT--to-dest 192.168.4.111

The Apache that came in from the extranet packets are sent to 4 via Destination address translation Network segment.

when testing, the client is only Apache package, can be seen.

In simple terms, the port itself does not divide the source port or the destination port, just for the direction of the packet, the same port can be used as a service to listen to the destination port of the extranet packet, but also as the source port to send the connection packet.