Configure iptables Firewall (2)
Configure iptables firewall (II)
Application of DNAT Policy
1. Clear all table firewalls
[root@s2 ~]# iptables -F
[root@s2 ~]# iptables -t nat -F
[root@s2 ~]# iptables -t raw -F
[root@s2 ~]# iptables -t mangle -F
2. Two network cards on the gateway firewall
[root@s2 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:87:17:A0
inet addr:192.168.10.10 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe87:17a0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:53 errors:0 dropped:0 overruns:0 frame:0
TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5525 (5.3 KiB) TX bytes:13431 (13.1 KiB)
Interrupt:59 Base address:0x2000
eth2 Link encap:Ethernet HWaddr 00:0C:29:87:17:AA
inet addr:200.100.100.1 Bcast:200.100.100.255 Mask:255.255.255.0
Confirm that the gateway can ping intranet clients and extranet clients.
[root@s2 ~]# ping 192.168.10.3
PING 192.168.10.3 (192.168.10.3) 56(84) bytes of data.
64 bytes from 192.168.10.3: icmp_seq=1 ttl=128 time=1.22 ms
--- 192.168.10.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.225/1.225/1.225/0.000 ms
[root@s2 ~]# ping 200.100.100.2
PING 200.100.100.2 (200.100.100.2) 56(84) bytes of data.
64 bytes from 200.100.100.2: icmp_seq=1 ttl=64 time=1.68 ms
64 bytes from 200.100.100.2: icmp_seq=2 ttl=64 time=0.375 ms
64 bytes from 200.100.100.2: icmp_seq=3 ttl=64 time=0.175 ms
--- 200.100.100.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.175/0.744/1.682/0.668 ms
3. Confirm to enable route forwarding
[root@s2 ~]# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@s2 ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
4. Add DNAT mapping to the gateway. For packets accessing port 80 of the gateway, change the destination address to the IP address of the intranet of the website server.
[root@s2 ~]# iptables -t nat -A PREROUTING -i eth1 -d 200.100.100.1 -p tcp --dport 80 -j DNAT --to-destination 192.168.10.3
5. Under the test, users from outside the network access the Web server of the intranet
SNAT policy application
1. Clear all table firewalls
[root@s2 ~]# iptables -F
[root@s2 ~]# iptables -t nat -F
[root@s2 ~]# iptables -t raw -F
[root@s2 ~]# iptables -t mangle -F
2. Two network cards on the gateway firewall
[root@s2 ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:87:17:A0
inet addr:192.168.10.10 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe87:17a0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:53 errors:0 dropped:0 overruns:0 frame:0
TX packets:80 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5525 (5.3 KiB) TX bytes:13431 (13.1 KiB)
Interrupt:59 Base address:0x2000
eth2 Link encap:Ethernet HWaddr 00:0C:29:87:17:AA
inet addr:200.100.100.1 Bcast:200.100.100.255 Mask:255.255.255.0
Confirm that the gateway can ping intranet clients and extranet clients.
[root@s2 ~]# ping 192.168.10.3
PING 192.168.10.3 (192.168.10.3) 56(84) bytes of data.
64 bytes from 192.168.10.3: icmp_seq=1 ttl=128 time=1.22 ms
--- 192.168.10.3 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.225/1.225/1.225/0.000 ms
[root@s2 ~]# ping 200.100.100.2
PING 200.100.100.2 (200.100.100.2) 56(84) bytes of data.
64 bytes from 200.100.100.2: icmp_seq=1 ttl=64 time=1.68 ms
64 bytes from 200.100.100.2: icmp_seq=2 ttl=64 time=0.375 ms
64 bytes from 200.100.100.2: icmp_seq=3 ttl=64 time=0.175 ms
--- 200.100.100.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.175/0.744/1.682/0.668 ms
3. Confirm to enable route forwarding
[root@s2 ~]# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@s2 ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456
6. SNAT policy is adopted for packets accessing Internet data for the local area network, and the source address is changed to the IP of the public network of the server.
address
[root@s2 ~]# iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source 200.100.100.1
7. Intranet client access to external network Web server test
