Linux
iptables 不會重定向
我正在嘗試將埠 102 上的所有 tcp 流量從單個 ip 地址重定向到另一個 ip 地址,並且還想偽裝 ip
我正在使用這個 iptable 配置,但我仍然無法連接。
iptables -t nat -A PREROUTING -s 195.190.131.189 -d 195.190.131.180 -p tcp --dport 102 -j DNAT --to 192.168.251.10:102 iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 102 -j MASQUERADE iptables -t nat -I POSTROUTING 1 -p tcp --dport 102 -j LOG --log-level 2 iptables -t nat -I PREROUTING 1 -p tcp --dport 102 -j LOG --log-level 2 iptables -t nat -I OUTPUT 1 -p tcp --dport 102 -j LOG --log-level 2
iptable -t nat -L -nv 顯示
Chain PREROUTING (policy ACCEPT 5 packets, 292 bytes) pkts bytes target prot opt in out source destination 3 152 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2 3 152 DNAT tcp -- * * 195.190.131.189 195.190.131.180 tcp dpt:102 to:192.168.251.10:102 Chain POSTROUTING (policy ACCEPT 11 packets, 660 bytes) pkts bytes target prot opt in out source destination 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2 0 0 MASQUERADE tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 Chain OUTPUT (policy ACCEPT 11 packets, 660 bytes) pkts bytes target prot opt in out source destination 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2
所以據我了解,數據包被發送到 DNAT。
是不是消息日誌沒有顯示輸出界面的問題:
Sep 24 20:14:28 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=6511 DF PROTO=TCP SPT=53696 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0 Sep 24 20:19:18 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=6701 DF PROTO=TCP SPT=53709 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0 Sep 24 20:19:21 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=6703 DF PROTO=TCP SPT=53709 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0 Sep 24 20:19:27 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=6707 DF PROTO=TCP SPT=53709 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0
你想這樣做嗎?
{客戶端}(port_random)—–(port12345){you}(port_random)—–(port4321){111.111.111.111}
iptables -t nat -A PREROUTING -p tcp --dport 12345 -j DNAT --to-destination 111.111.111.111:4321 iptables -A FORWARD -p tcp -d 111.111.111.111 --dport 4321 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -d 111.111.111.111 -o eth0 -j MASQUERADE