NAT问题！！

wuguang1023

为了可以从外网登陆局域网内的一台机子。我在代理下做了如下设置
iptables -t nat -A PREROUTING -d 61.150.76.* -p tcp --dport 22 -j DNAT --to 192.168.1.114:22
为什么不行呀 。。。。。代理上面22端口也没用（SSH为3347）。。。。

ssffzz1

61.150.76.*
这个IP是你的LINUX机器的外网IP吗？

wuguang1023

原帖由 ssffzz1 于 2007-8-27 18:12 发表
61.150.76.*
这个IP是你的LINUX机器的外网IP吗？

这个上我的代理服务器外网IP地址。。。

luo118

路过,学习中.................

platinum

Did your server in LAN access the port 22?
Did your server's default gateway in LAN point to the private address in Linux which has 61.150.76.*?
Is there any rules before "iptables -t nat -A PREROUTING -d 61.150.76.*...."?
Is there any rules in your table filter chain FORWARD?
What is your FORWARD default policy?

Show us more information if you need help!

[ 本帖最后由 platinum 于 2007-8-27 20:08 编辑 ]

jsjzhang

platinum的E文也这么好，我得加紧学习

wuguang1023

我想实现的内网机子打开了22端口。
我的代理是外网是61.150.76.*
内网是192。168。1。114
NAT代理服务器代码：
/sbin/modprobe ip_tables -F
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "262144" > /proc/sys/net/ipv4/ip_conntrack_max
iptables -t nat -A PREROUTING -d 61.150.76.* -p tcp --dport 22 -j DNAT --to 192.168.1.114:22
代理上面 SSH监听的是2046

platinum

What's your iptables' version?
If the version < 1.3.1, then you need add this command.
iptables -t nat -A POSTROUTING -s 192.168.1.114 -p tcp --sport 22 -j SNAT --to 61.150.76.*

[ 本帖最后由 platinum 于 2007-8-28 12:53 编辑 ]

wuguang1023

[root@server root]# rpm -qa |grep iptables
iptables-1.2.7a-2
被BZ说中拉 我改下试试

wuguang1023

[root@server root]# iptables-save
# Generated by iptables-save v1.2.7a on Wed Aug 29 04:42:50 2007
*filter
:INPUT ACCEPT [834:50872]
:FORWARD ACCEPT [19:6799]
:OUTPUT ACCEPT [384:31192]
-A INPUT -s 61.172.196.104 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
-A FORWARD -j ACCEPT
COMMIT
# Completed on Wed Aug 29 04:42:50 2007
# Generated by iptables-save v1.2.7a on Wed Aug 29 04:42:50 2007
*nat
REROUTING ACCEPT [1698089:108773147]
OSTROUTING ACCEPT [2043:152728]
:OUTPUT ACCEPT [861:127483]
-A PREROUTING -d 61.150.76.13 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.245:80
-A PREROUTING -d 61.150.76.13 -p tcp -m tcp --dport 21 -j DNAT --to-destination 192.168.1.114:21
-A PREROUTING -d 61.150.76.13 -i eth0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 192.168.1.114:22
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.1.114 -p tcp -m tcp --sport 22 -j SNAT --to-source 61.150.76.13
COMMIT