Shulou(Shulou.com)06/02 Report--

Today, I will talk to you about how to add port forwarding to iptables. Many people may not know much about it. In order to make you understand better, the editor has summarized the following for you. I hope you can get something according to this article.

What is iptables?

Iptables is not really a firewall, it's a firewall proxy. The real firewall is the security framework netfilter located in the kernel.

Iptables is a command-line tool located in user space to manipulate the netfilter framework

Note: firewall is a security management system set up between networks, which monitors data transmission according to policies.

Four tables and five chains of iptables

Four tables

Nat table: network address forwarding function; kernel module: iptable_nat

Filter table: filtering function; kernel module: iptable_nat

Raw table: state tracking table; kernel module: iptable_raw

Mangle table: the function of disassembling messages, making changes, and reencapsulating them; kernel module: iptable_mangle

Five chains

INPUT: inbound rule

OUTPUT: outbound rule

FORWARD: forwarding rules

PREROUTING: there are rules before the road.

POSTROUTING: there is a rule after the road.

Table chain relation

Raw--mangle--nat--filter

Table-function; chain-level

What are the functions of a certain level, that is to say, which table can the chain be in?

For example, PREROUTING can exist in: raw, mangle, nat table

When there is the same chain in the table, the priority of execution:

Iptables (netfilter) acts according to the rules, and this rule is chain. The netfilter of the kernel supports these rules

Depending on the situation, the message passes through different levels (chains), as shown in the following figure:

Message to a process on this machine: PREROUTING-- > INPUT

Messages forwarded to this machine: PREROUTING-- > FORWARD-- > POSTROUTING

A message is sent by a process on this machine: OUTPUT-- > POSTROUTING

The flow of data through the firewall

Processing action

ACCEPT: allow packets to pass through

DROP: drop packets directly

REJECT: denies packets from passing through

SNAT: source address translation for POSTROUTING chains

DNAT: destination address translation for PREROUTING chain

After reading the above, do you have any further understanding of how to add port forwarding in iptables? If you want to know more knowledge or related content, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.