SAME v1.2.11 options:
--to <ipaddr>-<ipaddr>
Addresses to map source to.
May be specified more than
once for multiple ranges.
--nodst
Don't use destination-ip in
source selection作者: wchun 时间: 2006-09-30 09:44
60000个端口，表示你可以向同一个ip地址同一个端口发起60000个连接？
好像不是这样子的吧？
NAT必须要建立一个会话表来对应数据包与内部真实主机的对应关系.作者: wchun 时间: 2006-09-30 09:49
11.16. SAME target
The SAME target works almost in the same fashion as the SNAT target, but it still differs. Basically, the SAME target will try to always use the same outgoing IP address for all connections initiated by a single host on your network. For example, say you have one /24 network (192.168.1.0) and 3 IP addresses (10.5.6.7-9). Now, if 192.168.1.20 went out through the .7 address the first time, the firewall will try to keep that machine always going out through that IP address.
谢谢，看起来很不错，等我试试~作者: wchun 时间: 2006-09-30 10:13
Option --to
Example iptables -t mangle -A PREROUTING -s 192.168.1.0/24 -j SAME --to 10.5.6.7-10.5.6.9
Explanation As you can see, the --to argument takes 2 IP addresses bound together by a - sign. These IP addresses, and all in between, are the IP addresses that we NAT to using the SAME algorithm.
Option --nodst
Example iptables -t mangle -A PREROUTING -s 192.168.1.0/24 -j SAME --to 10.5.6.7-10.5.6.9 --nodst
Explanation Under normal action, the SAME target is calculating the followup connections based on both destination and source IP addresses. Using the --nodst option, it uses only the source IP address to find out which outgoing IP the NAT function should use for the specific connection. Without this argument, it uses a combination of the destination and source IP address.作者: wchun 时间: 2006-09-30 11:33
谢谢，现在已经正常了。
把原先的
/sbin/iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -j SNAT --to-source xxx.xxx.xxx.1-xxx.xxx.xxx.6
修改为
/sbin/iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -j SAME --to xxx.xxx.xxx.1-xxx.xxx.xxx.6