Iptables port mapping instance

Environment:

Host 1: IP: 192.168.10.25 (can access external network)

IP: 192.168.100.1 (Gateway)

Host 2: IP: 192.168.100.23 (web server)

Requirements: IP segment 192.168.10.0/24 can access the web server, and the web server can also access the external network.

Note: 192.168.10.0/24 and 192.168.100.0/24 cannot be connected.

Set Host 2:

Configure IP and route

Configure Host 2 IP Address: 192.168.100.23

Check if route's default gateway is 192.168.100.1

[root@haproxy02 sysconfig]# route Kernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface192.168.100.0 * 255.255.255.0 U 0 0 0 eth2link-local * 255.255.0.0 U 1003 0 0 eth2default 192.168.100.1 0.0.0.0 UG 0 0 0 eth2

Add default gateway if not set

route add default gw 192.168.100.1

Gateway permanently in effect: vim /etc/sysconfig/static-routes

any net default gw 192.168.100.1

Host 1 Configuration:

Set up two ip and assign two network ports respectively

eth0：192.168.10.25

eth2：192.168.100.1

The default gateway for route is 192.168.10.1

default 192.168.10.1 0.0.0.0 UG 0 0 0 eth0

Open ip forwarding function under linux

vim /etc/sysctl.conf

net.ipv4.ip_forward = 1

sysctl -p /etc/sysctl.conf

iptables policy

-A PREROUTING -d 192.168.10.25/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.100.23 -A POSTROUTING -s 192.168.100.0/24 -o eth0 -j SNAT --to-source 192.168.10.25 -A POSTROUTING -d 192.168.100.0/24 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.100.1