Shulou(Shulou.com)06/01 Report--

Configure iptables firewall (II)

Application of DNAT Policy

1. Clear all table firewalls

[root@s2 ~]# iptables -F

[root@s2 ~]# iptables -t nat -F

[root@s2 ~]# iptables -t raw -F

[root@s2 ~]# iptables -t mangle -F

2. Two network cards on the gateway firewall

[root@s2 ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:87:17:A0

inet addr:192.168.10.10 Bcast:192.168.10.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fe87:17a0/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:53 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:5525 (5.3 KiB) TX bytes:13431 (13.1 KiB)

Interrupt:59 Base address:0x2000

eth2 Link encap:Ethernet HWaddr 00:0C:29:87:17:AA

inet addr:200.100.100.1 Bcast:200.100.100.255 Mask:255.255.255.0

Confirm that the gateway can ping intranet clients and extranet clients.

[root@s2 ~]# ping 192.168.10.3

PING 192.168.10.3 (192.168.10.3) 56(84) bytes of data.

64 bytes from 192.168.10.3: icmp_seq=1 ttl=128 time=1.22 ms

--- 192.168.10.3 ping statistics ---

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 1.225/1.225/1.225/0.000 ms

[root@s2 ~]# ping 200.100.100.2

PING 200.100.100.2 (200.100.100.2) 56(84) bytes of data.

64 bytes from 200.100.100.2: icmp_seq=1 ttl=64 time=1.68 ms

64 bytes from 200.100.100.2: icmp_seq=2 ttl=64 time=0.375 ms

64 bytes from 200.100.100.2: icmp_seq=3 ttl=64 time=0.175 ms

--- 200.100.100.2 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 1999ms

rtt min/avg/max/mdev = 0.175/0.744/1.682/0.668 ms

3. Confirm to enable route forwarding

[root@s2 ~]# vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

[root@s2 ~]# sysctl -p

net.ipv4.ip_forward = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.accept_source_route = 0

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.ipv4.tcp_syncookies = 1

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = 4294967295

kernel.shmall = 268435456

4. Add DNAT mapping to the gateway. For packets accessing port 80 of the gateway, change the destination address to the IP address of the intranet of the website server.

[root@s2 ~]# iptables -t nat -A PREROUTING -i eth1 -d 200.100.100.1 -p tcp --dport 80 -j DNAT --to-destination 192.168.10.3

5. Under the test, users from outside the network access the Web server of the intranet

SNAT policy application

1. Clear all table firewalls

[root@s2 ~]# iptables -F

[root@s2 ~]# iptables -t nat -F

[root@s2 ~]# iptables -t raw -F

[root@s2 ~]# iptables -t mangle -F

2. Two network cards on the gateway firewall

[root@s2 ~]# ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:87:17:A0

inet addr:192.168.10.10 Bcast:192.168.10.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fe87:17a0/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:53 errors:0 dropped:0 overruns:0 frame:0

TX packets:80 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:5525 (5.3 KiB) TX bytes:13431 (13.1 KiB)

Interrupt:59 Base address:0x2000

eth2 Link encap:Ethernet HWaddr 00:0C:29:87:17:AA

inet addr:200.100.100.1 Bcast:200.100.100.255 Mask:255.255.255.0

Confirm that the gateway can ping intranet clients and extranet clients.

[root@s2 ~]# ping 192.168.10.3

PING 192.168.10.3 (192.168.10.3) 56(84) bytes of data.

64 bytes from 192.168.10.3: icmp_seq=1 ttl=128 time=1.22 ms

--- 192.168.10.3 ping statistics ---

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 1.225/1.225/1.225/0.000 ms

[root@s2 ~]# ping 200.100.100.2

PING 200.100.100.2 (200.100.100.2) 56(84) bytes of data.

64 bytes from 200.100.100.2: icmp_seq=1 ttl=64 time=1.68 ms

64 bytes from 200.100.100.2: icmp_seq=2 ttl=64 time=0.375 ms

64 bytes from 200.100.100.2: icmp_seq=3 ttl=64 time=0.175 ms

--- 200.100.100.2 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 1999ms

rtt min/avg/max/mdev = 0.175/0.744/1.682/0.668 ms

3. Confirm to enable route forwarding

[root@s2 ~]# vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

[root@s2 ~]# sysctl -p

net.ipv4.ip_forward = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.accept_source_route = 0

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.ipv4.tcp_syncookies = 1

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax = 4294967295

kernel.shmall = 268435456

6. SNAT policy is adopted for packets accessing Internet data for the local area network, and the source address is changed to the IP of the public network of the server.

address

[root@s2 ~]# iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source 200.100.100.1

7. Intranet client access to external network Web server test

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.