Use iptables for NAT in LINUX

In LINUX, iptables is used to implement NAT-Linux Enterprise Application-Linux server application information. The following is a detailed description. (1) Iptables syntax
When using the NAT Function of iptables, you must use the "-t nat" display in each rule to use the nat table. Use the following options ::
1. Operations on Rules
Add (append) A new rule to the end of A chain (-.
Insert a new rule (-I) at a location in the chain, usually at the beginning.
Replace a rule (-R) at a certain position in the chain ).
Delete a rule (-D) at a location in the chain ).
Delete the first rule (-D) in the chain ).
2. Specify the source address and Destination Address
Use -- source/-- src/-s to specify the source address (here/Represents or means, the same below), and use -- destination/-- dst/-s to specify the destination address. You can use the following four methods to specify an IP Address:
A. Use a complete domain name, such as "www.linuxaid.com.cn ";
B. Use an IP address, such as "192.168.1.1 ";
C. Use x. x/x. x to specify a network address, such as "192.168.1.0/255.255.255.0 ";
D. use x. x. x. x/x specifies a network address. For example, "192.168.1.0/24" indicates the number of valid digits of the subnet mask, which is usually used in UNIX environments.
The default subnet mask number is 32, that is, specifying 192.168.1.1 is equivalent to 192.168.1.1/32.
3. Specify Network Interfaces
You can use -- in-interface/-I or -- out-interface/-o to specify network interfaces. From the principle of NAT, we can see that for the PREROUTING chain, we can only use-I to specify the incoming network interface; For POSTROUTING and OUTPUT, we can only use the network interface specified by-o.
4. Specify the protocol and Port
You can use the -- protocol/-p option to specify the protocol. For udp and tcp Protocols, you can also specify the port using -- source-port/-- sport and -- destination-port/-- dport.

(2) iptabls instances:
Assume that the IP address of a Wan is a. B. c. d gateway a. B. c. x mask 255.255.255.252
The IP address of the LAN is 192.168.0.1-192.168.0.255 gateway 192.168.0.1.
The software environment is: Linux7.2 Select server Installation
Specify eth0: a. B. c. d eth1: 192.168.0.1
Add a Fuel table
Vi/etc/sysconfig/static-routes
Etho net a. B. c. d netmask 255.255.255.252 gw a. B. c. x
Eth1 net 192.168.0.1netmask 255.255.255.0 gw 192.168.0.1
Gateway
Vi/etc/sysconfig/network
NETWORKING = yes
GATEWAYDEV = eth0
GATEWAY = a. B. c. x
HOSTNAME = (host name)
Starting Road Oil
Vi/etc/sysctl. conf
Net. ipv4.ip _ forward = 1
Net. ipv4.conf. default. rp_filter = 1
Kernel. core_uses_pid = 1
Kernel. sysrq = 0
Configure iptables scripts
Create rc. fw
# For this to run iptables firewall
! /Bin/sh
/Sbin/modprobe ip_tables
/Sbin/modprobe ip_nat_ftp
/Sbin/modprobe ip_conntrack_ftp
/Sbin/iptables-F
/Sbin/iptables-F-t nat
/Sbin/iptables-X
/Sbin/iptables-Z
Echo "1">/proc/sys/net/ipv4/ip_forward
/Sbin/iptables-P INPUT ACCEPT
/Sbin/iptables-P FORWARD ACCEPT
/Sbin/iptables-P OUTPUT ACCEPT
Iptables-t nat-a postrouting-o eth0-j MASQUERADE
Iptables-a forward-s 0/0-d 0/0-j ACCEPT
There are no restrictions on the above iptables. You can customize the security restrictions if you want to have some security restrictions.
New Join
(3) port forwarding
Assume that there is an internal www server and an ftp server.
The addresses are 192.168.0.8 (www)
192.168.0.9 (ftp)
Add
Iptables-t nat-a prerouting-d a. B. c. d-p tcp -- dport 80? J DNAT -- to 192.168.0.8: 80
Iptables-t nat-a prerouting-d a. B. c. d-p tcp -- dport 21-j DNAT -- to 192.168.0.9: 21
Appendix:
-P specifies the protocol (-- protocol)
-- Dport indicates the port (-- source-port/-- sport and -- destination-port)
-I or-o specifies the network interface (-I POSTROUTING FOR THE PREROUTING chain)
-S indicates the source address (-- source/-- src/source address destination/-- dst/destination address)
-A adds A new rule to A chain (generally written to the end) (append)
-I insert (insert) to the end of a chain
-R replaces a rule at a certain position in the chain.
-D. delete the first rule in the chain)
-D specify the destination address
--------------------------------------
The following is an iptable script with no security performance.
Touch/var/lock/subsys/local
# For this to run iptables firewall
! /Bin/sh
/Sbin/modprobe ip_tables
/Sbin/modprobe ip_nat_ftp
/Sbin/modprobe ip_conntrack_ftp
/Sbin/iptables-F
/Sbin/iptables-F-t nat
/Sbin/iptables-X
/Sbin/iptables-Z
/Sbin/iptables-P INPUT ACCEPT
/Sbin/iptables-P FORWARD ACCEPT
/Sbin/iptables-P OUTPUT ACCEPT

Echo "1">/proc/sys/net/ipv4/ip_forward
/Sbin/iptables-t nat-a postrouting-o eth0-j MASQUERADE
/Sbin/iptables-a forward-s 0/0-d 0/0-j ACCEPT

----------------------------------------
Iptables filter rules
# Filter table rules

* Filter

# General by default
: Forward drop []
: Input drop []
: Output accept []

# Define a new chain
-N ICMP_FORWARD
-N TCP_FORWARD
-N UDP_FORWARD
-N ICMP_INPUT
-N TCP_INPUT
-N UDP_INPUT

# Fix a bug
-A output-p icmp-m state -- state INVALID-j DROP

# The following are the rules of the FORWARD chain.
# Jump to ICMP_FORWARD if ICMP is used
-A forward-p icmp-j ICMP_FORWARD
# Skip to TCP_FORWARD if the TCP protocol is used
-A forward-p tcp-j TCP_FORWARD
# Skip to UDP_FORWARD if UDP is used
-A forward-p udp-j UDP_FORWARD
# The fragment passing rate is 200/s, and the count starts from 200.
-A forward-f-m limit -- limit 200/s -- limit-burst 200-j ACCEPT
# If all rules of the FORWARD chain are not matched, discard the packet and end the FORWARD chain.
-A forward-j DROP

# The following are the rules for ICMP in the FORWARD chain:
# Allow from Intranet to Internet
-A ICMP_FORWARD-p icmp-s 192.168.0.0/24-I eth0-o ppp +-j ACCEPT
# Allow response packets from the Internet
-A ICMP_FORWARD-p icmp-m state -- state ESTABLISHED, RELATED-I ppp +-j ACCEPT
# Discard all unmatched ICMP packets and end the FORWARD chain
-A ICMP_FORWARD-p icmp-j DROP

# The following are the rules for TCP in the FORWARD chain:
# Allow ports over 1024 of the Intranet to connect to the Internet
-A TCP_FORWARD-p tcp-s 192.168.0.0/24-m tcp -- sport 1024:-I eth0-o ppp +-j ACCEPT
# Allow active FTP over the Intranet
-A TCP_FORWARD-p tcp-m tcp -- sport 21 -- dport 1024:-m state -- state ESTABLISHED-I ppp +-j ACCEPT
-A TCP_FORWARD-p tcp-m tcp -- sport 20 -- dport 1024:-m state -- state ESTABLISHED, RELATED-I ppp +-j ACCEPT
# Allow incoming response packets from the Internet to pass through
-A TCP_FORWARD-p tcp-m state -- state ESTABLISHED-m tcp -- dport 1024:-I ppp +-j ACCEPT
# Discard all unmatched TCP packets and end the FORWARD chain
-A TCP_FORWARD-p tcp-j DROP

# The following are UDP protocol rules in the FORWARD chain:
# Allow ports over 1024 of the Intranet to connect to the Internet
-A UDP_FORWARD-p udp-s 192.168.0.0/24-m udp -- sport 1024:-I eth0-o ppp +-j ACCEPT
# Allow DNS servers specified on the Internet to perform domain name resolution
-A UDP_FORWARD-p udp-s 202.96.96.68-m udp -- sport 53 -- dport 1024:-I ppp +-j ACCEPT
-A UDP_FORWARD-p udp-s 202. 96. *. *-m udp -- sport 53 -- dport 1024:-I ppp +-j ACCEPT
# Open the irc oicq Port
-A UDP_FORWARD-p udp-m multiport -- source-port 1024, 8000-m udp -- dport:-I ppp +-j ACCEPT
# Allow access to UDP response packets from the Internet
-A UDP_FORWARD-p udp-m state -- state ESTABLISHED, RELATED-m udp -- dport 1024:-I ppp +-j ACCEPT
# Discard all unmatched UDP packets and end the FORWARD chain
-A UDP_FORWARD-p udp-j DROP

# The following is the matching rule for the gateway server.

# Allow data packets to enter the local loopback interface
-A input-p all-I lo-j ACCEPT

# Skip to ICMP_INPUT for rule matching if the ICMP protocol is used
-A input-p icmp-j ICMP_INPUT
# Skip to TCP_INPUT for rule matching if the protocol is TCP
-A input-p tcp-j TCP_INPUT
# Skip to UDP_INPUT for rule matching if UDP is used
-A input-p udp-j UDP_INPUT
# The fragment passing rate is 200/s, and the count starts from 200.
-A input-f-m limit -- limit 200/s -- limit-burst 200-j ACCEPT
# If all rules of the INPUT chain are not matched, discard the data packet and end the INPUT chain
-A input-j DROP

# The following are the ICMP protocol rules in the INPUT chain:
# Allow ICMP packets from the Intranet
-A ICMP_INPUT-p icmp-I eth0-j ACCEPT
# Allow access to ICMP response packets from the Internet
-A ICMP_INPUT-p icmp-m state -- state ESTABLISHED, RELATED-I ppp +-j ACCEPT
# Discard all unmatched ICMP packets and end the INPUT chain
-A ICMP_INPUT-p icmp-j DROP

# The following are the TCP rules in the INPUT chain.
# Provide transparent proxy service for http https network neighbors to intranet machines
-A TCP_INPUT-p tcp-s 192.168.0.0/24-m multiport -- destination-port 80,443,137,138,139,808 0-I eth0-j ACCEPT
# Allow the server to actively connect to the FTP server on the Internet
-A TCP_INPUT-p tcp-m tcp -- sport 21 -- dport 1024:-m state -- state ESTABLISHED-I ppp +-j ACCEPT
-A TCP_INPUT-p tcp-m tcp -- sport 20 -- dport 1024:-m state -- state ESTABLISHED, RELATED-I ppp +-j ACCEPT
# Provide ssh smtp pop3 http https service
-A TCP_INPUT-p tcp-m multiport -- destination-port 443,-j ACCEPT
# Rejecting the Internet to actively connect to the server
-A TCP_INPUT-p tcp-m tcp -- syn-I ppp +-j DROP
# Allow incoming response packets to pass
-A TCP_INPUT-p tcp-m state -- state ESTABLISHED-m tcp -- dport 1024:-j ACCEPT
# Discard all unmatched TCP packets and end the INPUT chain
-A TCP_INPUT-p tcp-j DROP

# The following are UDP protocol rules in the INPUT chain:
# Allow DNS servers specified on the Internet to perform domain name resolution
-A UDP_INPUT-p udp-s 202.96.96.68-m udp -- sport 53 -- dport 1024:-I ppp +-j ACCEPT
-A UDP_INPUT-p udp-s 202. 96. *. *-m udp -- sport 53 -- dport 1024:-I ppp +-j ACCEPT
# Providing DNS and SAMBA services for Intranet machines
-A UDP_INPUT-p udp-s 192.168.0.0/24-m multiport -- destination-port 53,137,138,139-I eth0-j ACCEPT
# Allow the server as the samba client
-A UDP_INPUT-p udp-s 192.168.0.0/24-m udp -- sport 137: 139 -- dport 1024:-I eth0-j ACCEPT
# Allow incoming response packets to pass
-A UDP_INPUT-p udp-m state -- state ESTABLISHED, RELATED-m udp -- dport 1024:-j ACCEPT
# Providing DHCP service for Intranet machines
-A UDP_INPUT-p udp-m udp -- sport 68 -- dport 67-I eth0-j ACCEPT
# Discard all unmatched UDP packets and end the INPUT chain
-A UDP_INPUT-p udp-j DROP

COMMIT


# Route table rules

* Nat

# General by default
: Prerouting accept []
: Postrouting accept []
: Output accept []

# Use the squid transparent proxy for port redirection for Intranet machines
-A prerouting-I eth0-p tcp-d! 192.168.0.1-m tcp -- dport 80-j REDIRECT -- to-ports 8080
# Disguise the IP address of an Intranet machine application
-A postrouting-o ppp +-j MASQUERADE

COMMIT