iptables ftp 端口转发 iptable udp转发

iptables 端口转发(CentOS)

注意：一来一去
在中转服务器操作

iptables -t nat -A PREROUTING -p tcp --dport [端口号] -j DNAT --to-destination [目标IP] iptables -t nat -A POSTROUTING -p tcp -d [目标IP] --dport [端口号] -j SNAT --to-source [中转服务器IP]

不同端口转发

本地网络连接的端口依旧是10010，而不是10086

$ iptables -t nat -A PREROUTING -p tcp -m tcp --dport 10010 -j DNAT --to-destination 103.79.78.76:10086 $ iptables -t nat -A POSTROUTING -p tcp -m tcp -d 103.79.78.76 --dport 10086 -j SNAT --to-source 183.60.100.8

ufw端口转发(Ubuntu)

编辑 etc/default/ufw文件中更改参数DEFAULT_FORWARD_POLICY

1

default_forward_policy = "accept"

配置/etc/ufw/sysctl.conf 允许ipv4转发（默认情况下，参数被注释掉）。如果你想要ipv6取消注释。

1 2 3

net/ipv4/ip_forward=1 #net/ipv6/conf/default/forwarding=1 #net/ipv6/conf/all/forwarding=1

最后一步是添加NAT到/etc/ufw/before.rules的配置。将以下内容添加到过滤器规则（*filter）之前

11
# NAT Table rules #2017/10/11
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Port Forwardings 
-A PREROUTING -p tcp --dport 10010 -j DNAT --to-destination 103.79.78.76
-A POSTROUTING -p tcp -d 103.79.78.76 --dport 10010 -j SNAT --to-source 183.60.100.8

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

注意*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。

现在通过重新启动ufw启用更改。

1

sudo ufw disable && sudo ufw enable

查看iptables生效状态

在中转服务器查看:  

iptables -t nat -L -v

///

ubuntu下的ufw

ubuntu为了方面使用对底层的iptables做了一层配置简化，底层机制还是iptables,通过iptables可以请求实现端口映射、nat等，下面对ufw的配置做描述

安装: sudo apt install ufw

启动: sudo ufw ebable

停止: sudo ufw disable

状态: sudo ufw status

重载：sudo ufw reload

主要配置文件：

1、/etc/default/ufw

2、/etc/ufw/sysctl.conf

3、/etc/ufw/before.rules

说明：

1、ufw默认是将filter的input设置成了DROP，也就是说如果开启防火墙，默认情况下外部不能主动访问该节点了，所有需要修改INPUT策略，可以直接将 DEFAULT_INPUT_POLICY设置为ACCEPT

2、除了用 ufw命令或上面的配置文件外，原来的iptables命令也同样是有效的，实际上ufw的配置规则和iptables基本也一样

配置端口映射举例，

例如将8554映射到192.168.4.99:554，

本机的对外口为192.168.35.50，内网为192.168.4.102

方法一：iptables配置:

sudo iptables -t nat -A PREROUTING -p tcp --dport 8554 -j DNAT --to-destination 192.168.4.99:554

sudo iptables -t nat -A POSTROUTING -d 192.168.4.99 -p tcp --dport 554 -j SNAT --to-source 192.168.4.102

sudo iptables -A FORWARD -j ACCEPT

将net/ipv4/ip_forward设置为1

方法二：ufw配置

1、/etc/ufw/sysctl.conf中将net/ipv4/ip_forward设置为1

2、/etc/default/ufw中将DEFAULT_INPUT_POLICY设置为ACCEPT

3、/etc/default/ufw中将DEFAULT_FORWARD_POLICY设置为ACCEPT

4、修改/etc/ufw/before.rules，添加nat规则，在最后添加

*nat

:PREROUTING - [0:0]

:POSTROUTING - [0:0]

-A PREROUTING -p tcp --dport 8554 -j DNAT --to-destination 192.168.4.99:554

-A POSTROUTING -d 192.168.4.99 -p tcp --dport 554 -j SNAT --to-source 192.168.4.102

COMMIT

///

/// 91V 代理从机网页方法 ///

本地网络 >> 中转IP:192.168.44.100 >> 目标IP:1192.168.44.101

//参考链接：

*nat
:PREROUTING - [0:0]
:POSTROUTING - [0:0]
-A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.44.101:80
-A PREROUTING -p tcp --dport 6692 -j DNAT --to-destination 192.168.44.101:6692
-A POSTROUTING -p tcp -d 192.168.44.101 --dport 80 -j SNAT --to-source 192.168.44.100
-A POSTROUTING -p tcp -d 192.168.44.101 --dport 6692 -j SNAT --to-source 192.168.44.100
COMMIT

注意事项：

（1）*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。

（2）配置完成，需要通过重新启动ufw启用更改，使之生效。

sudo ufw disable && sudo ufw enable

（3）GEAC91V，从机需要修改net.xml配置文件中的websocket通信端口号，6691->6692, web页面中的通信端口号也要同步修改：6691->6692

路径：cd /usr/local/mec/www/src/views/mec/js

/ 以下为修改后的 before.rules 内容///

#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw-before-input
#   ufw-before-output
#   ufw-before-forward
#

# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines


# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT

# quickly process packets for which we already have a connection
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP

# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT

# allow dhcp client to work
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT

#
# ufw-not-local
#
-A ufw-before-input -j ufw-not-local

# if LOCAL, RETURN
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN

# if MULTICAST, RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN

# if BROADCAST, RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN

# all other non-local packets are dropped
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP

# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT

# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT


*nat
:PREROUTING - [0:0]
:POSTROUTING - [0:0]
-A PREROUTING  -p tcp --dport 8080 -j DNAT --to-destination 192.168.44.101:80
-A PREROUTING  -p tcp --dport 6692 -j DNAT --to-destination 192.168.44.101:6692
-A POSTROUTING -p tcp -d 192.168.44.101 --dport 80 -j SNAT --to-source 192.168.44.100
-A POSTROUTING -p tcp -d 192.168.44.101 --dport 6692 -j SNAT --to-source 192.168.44.100
COMMIT