SNAT and DNAT of iptables Firewall

I. SNAT source address translation.

1. Principle: after the router (PSOTROUTING), the ip address of the internal network is modified to the ip address of the external network card.

2. Application scenario: share internal hosts to access the Internet.

3. Set SNAT: set it by the gateway host.

(1) set basic information such as ip address.

(2) enable routing:

Sed-I'/ ip-forward/s/0/1/g'

Sysctl-p

(3) Writing rules:

Iptables-t nat-I POSTROUTING-o public network card-s internal network segment-j SNAT-- to-source public network ip address # # suitable for public network ip address fixed scenarios

Iptables-t nat-I POSTROUTING-o external network card-s internal network segment-j MASQUERADE # # is suitable for sharing dynamic ip addresses to surf the Internet (such as adsl dialing, dhcp obtaining external network ip)

(4) do a good job of safety control: use FORWARD timing to control, and strictly set INPUT rules.

2. DNAT destination address translation:

1. Principle: before routing (PREROUTING), modify the destination ip and port from the public network ip of the external network access gateway and the corresponding port to the ip and port of the internal server to realize the release of the internal server.

2. Application scenario: publish internal host services.

3. Set DNAT: set it on the gateway host.

(1) set ip, enable routing, and set SNAT

(2) write firewall rules:

Iptables-t nat-I PREROUTING-I public network card-d public network ip tcp-- port issued by dport-j DNAT-- to-destination internal network service ip: Port