iptables总结

1.修改内核变量ip_forward
#echo "1" > /proc/sys/net/ipv4/ip_froward

2.修改脚本/etc/sysconfig/network
将FROWARD_IPV4=false 改为 FROWARD_IPV4=true
开启SSH使用的TCP协议22端口
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
开启DNS使用UDP、TCP的53端口
iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT

配置SNAT命令基本语法
iptables -t nat -A POSTROUTING -o 网络接口 -j SNAT --to-source IP地址
把10.0网段通过221.130.58.52转发出去
iptables -t nat -A POSTROUTING -s 10.0.0.0/255.255.255.0 -o eth1 -j SNAT --to-source 221.130.58.52
/etc/init.d/iptables save

配置DNAT命令基本语法
iptables -t nat -A PREROUTING -i 网络接口 -p 协议 --dport 端口 -j DNAT --to-destination IP地址
把202.202.202.1 的访问转发到内网192.168.0.101上
iptables -t nat -A PREROUTING -d 202.202.202.1 -j DNAT --to-destination 192.168.0.101
iptables -t nat -A POSTROUTING -d 192.168.0.101 -j SNAT --to 192.168.0.1
/etc/init.d/iptables save

 

NAT端口映射设置
由于局域网的地址为私网地址，在公网上不合法，所以必须将私网地址转为服务器的外部地址进行地址映射，连接外网接口为eth1

iptables -t nat -A POSTROUTING –o eth1 -s 192.168.0.0/24 -j MASQUERADE

MASQUERADE和SNAT作用一样 相样是提供源地址转换的操作，但是MASQUERADE是针对外部接口为动态IP地址来设置滴，不需要使用--to-source指定转换的IP地址。如果网络采用的是拨号方式接入互联网，而没有对外的静态IP地址（主要用在动态获取IP地址的连接，比如ADSL拨号、DHCP连接等等），那么建议使用MASQUERADE

注意：MASQUERADE是特殊的过滤规则，其只可以映射从一个接口到另一个接口的数据

内网机器对外发布WEB网站

内网WEB服务器IP地址为192.168.0.3，我们需要进行如下配置，当公网客户端访问服务器时，防火墙将请求映射到内网的192.168.0.3的80端口

接口做映射
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.3:80

ip做映射
iptables -t nat -A PREROUTING -d 221.130.58.50 -p tcp --dport 2222 -j DNAT --to-destination 10.0.0.3:22

示例：

v[root@localhost ~]# vi /etc/sysconfig/iptables
# Generated by iptables-save v1.3.5 on Fri Jan 21 16:03:20 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4692:403886]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A OUTPUT -p udp -m udp --sport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2222 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5631 -j ACCEPT
# Generated by iptables-save v1.3.5 on Fri Jan 21 16:03:20 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4692:403886]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A OUTPUT -p udp -m udp --sport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2222 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8601 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8681 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8680 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 9000 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3000 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 9528 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8001 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 81 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 82 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 7890 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8081 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8082 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8130 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8129 -j ACCEPT
-A RH-Fire