救教 iptables 端口转发如何设置

huang_bu

搞了一上午，还是没能搞通，不知哪里错了，
我现在是想通过访问外部机器：172.25.20.149
通过机器A:172.25.25.250:23直接映射到172.25.20.183机器
我做了如下设置：
iptables -I PREROUTING -t nat -d 172.25.27.250 -j DNAT --to 172.25.20.183
iptables -I POSTROUTING -t nat -d 172.25.20.183 -j MASQUERADE
还有开通FORWARDING:
iptables -A FORWARD -p tcp -s 172.25.20.149 -d 172.25.20.183 -j ACCEPT
iptables -A FORWARD -f -s 172.25.20.149 -d 172.25.20.183 -j ACCEPT
通过iptables -t nat -L如下：
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       all  --  anywhere             linux.site          to:172.25.20.183

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             172.25.20.183
MASQUERADE  all  --  anywhere             172.25.20.183

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
但还是不能连上哦，望kenduest 明示，万分感谢

[ 本帖最后由 huang_bu 于 2007-8-23 11:39 编辑 ]

platinum

试试这个

1. 
   
2. service iptables stop
   
3. iptables -t nat -A PREROUTING -d 211.11.11.11 -p tcp --dport 123 -j DNAT 211.11.11.12
   
4. iptables -t nat -A POSTROUTING -d 211.11.11.12 -p tcp --dport 123 -j SNAT --to 211.11.11.11
   
5. sysctl -w net.ipv4.ip_forward=1
   

复制代码

因为不知道你的 123 端口是跑在什么协议上的，所以上面暂时写成 tcp，若是 udp 的话请自行更改
若能解决你的问题，且想知道原理的话还需要去多理解

huang_bu

根据platinum的建议
iptables -t nat -A PREROUTING -d 211.11.11.11 -p tcp --dport 23 -j DNAT --to 211.11.11.12
iptables -t nat -A POSTROUTING -d 211.11.11.12 -p tcp --dport 23 -j SNAT --to 211.11.11.11
sysctl -w net.ipv4.ip_forward=1
后还是不行啊，我就是想替换telnet功能，不知道iptables有没有日志能让我跟踪察看一下的？

platinum

贴规则时要贴 iptables-save 的结果，这样才有利于排错
另外询问网络问题时你应该事先描述网络拓扑，没有网络拓扑结构任何猜测都是无用功

huang_bu

# Generated by iptables-save v1.2.9 on Thu Jul  5 02:52:47 2007
*mangle
REROUTING ACCEPT [50605:5043518]
:INPUT ACCEPT [24404:1772477]
:FORWARD ACCEPT [36:1728]
:OUTPUT ACCEPT [17931:2166337]
OSTROUTING ACCEPT [17944:2167077]
-A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --sport 20 -j TOS --set-tos 0x08
-A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 20 -j TOS --set-tos 0x08
-A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --sport 80 -j TOS --set-tos 0x08
-A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 80 -j TOS --set-tos 0x08
-A OUTPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --sport 53 -j TOS --set-tos 0x10
-A OUTPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 53 -j TOS --set-tos 0x10
-A OUTPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 161 -j TOS --set-tos 0x04
-A OUTPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 162 -j TOS --set-tos 0x04
-A OUTPUT -p udp -m udp --dport 514 -j TOS --set-tos 0x04
COMMIT
# Completed on Thu Jul  5 02:52:47 2007
# Generated by iptables-save v1.2.9 on Thu Jul  5 02:52:47 2007
*filter
:INPUT DROP [0:0]
:FORWARD DROP [27:1296]
:OUTPUT ACCEPT [36:2736]
:forward_dmz - [0:0]
:forward_ext - [0:0]
:forward_int - [0:0]
:input_dmz - [0:0]
:input_ext - [0:0]
:input_int - [0:0]
:reject_func - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 255.255.255.255 -i eth0 -j DROP
-A INPUT -d 172.25.255.255 -i eth0 -j DROP
-A INPUT -i eth0 -j input_ext
-A INPUT -j LOG --log-prefix "SFW2-IN-ILL-TARGET " --log-tcp-options --log-ip-options
-A INPUT -j DROP
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 11 -j LOG --log-prefix "SFW2-OUT-TRACERT-ATTEMPT " --log-tcp-options --log-ip-options
-A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3/3 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3/9 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3/10 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3/13 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3 -j DROP
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j LOG --log-prefix "SFW2-OUTPUT-ERROR " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 11 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 12 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 14 -j ACCEPT
-A input_dmz -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 18 -j ACCEPT
-A input_dmz -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 2 -j LOG --log-prefix "SFW2-INdmz-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -j DROP
-A input_dmz -p tcp -m tcp --dport 113 --tcp-flags SYN,RST,ACK SYN -j reject_func
-A input_dmz -p tcp -m tcp --dport 11 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 11 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 15 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 15 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 515 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 515 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 873 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 873 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 2401 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 2401 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 5801 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 5801 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 5802 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 5802 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 5803 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 5803 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 5901 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 5901 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 5902 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 5902 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m tcp --dport 5903 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m tcp --dport 5903 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_dmz -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-ACC-HiTCP " --log-tcp-options --log-ip-options
-A input_dmz -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_dmz -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_dmz -p udp -m udp --dport 11 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 15 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 21 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 22 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 23 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 69 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 389 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 389 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 515 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 873 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 1024 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 1025 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 2401 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 5801 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 5802 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 5803 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 5901 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 5902 -m state --state NEW -j DROP
-A input_dmz -p udp -m udp --dport 5903 -m state --state NEW -j DROP
-A input_dmz -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -p udp -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_dmz -m state --state INVALID -j LOG --log-prefix "SFW2-INdmz-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A input_dmz -j DROP
-A input_ext -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INext-ACC-SOURCEQUENCH " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 11 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 12 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 14 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 18 -j ACCEPT
-A input_ext -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INext-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INext-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INext-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INext-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 2 -j LOG --log-prefix "SFW2-INext-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -j DROP
-A input_ext -p tcp -m tcp --dport 20:21 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 20:21 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 3306 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 3306 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 3690 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 3690 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 5801:5906 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 5801:5906 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 8090 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 8090 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 80 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 443 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 443 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 110 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 110 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 995 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 995 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 25 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 25 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 22 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 23 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 113 --tcp-flags SYN,RST,ACK SYN -j reject_func
-A input_ext -p tcp -m tcp --dport 11 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 11 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 15 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 15 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 427 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 427 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 515 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 515 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 873 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 873 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 2401 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 2401 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 5801 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 5801 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 5802 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 5802 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 5803 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options

huang_bu

-A input_ext -p tcp -m tcp --dport 5803 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 5901 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 5901 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 5902 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 5902 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m tcp --dport 5903 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 5903 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_ext -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-HiTCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_ext -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_ext -p udp -m udp --dport 11 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 15 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 21 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 22 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 23 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 69 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 389 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 389 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 427 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 427 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 515 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 873 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 1024 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 1025 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 2401 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5353 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5801 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5802 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5803 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5901 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5902 -m state --state NEW -j DROP
-A input_ext -p udp -m udp --dport 5903 -m state --state NEW -j DROP
-A input_ext -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p udp -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -m state --state INVALID -j LOG --log-prefix "SFW2-INext-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A input_ext -j DROP
-A input_int -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A input_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3 -j ACCEPT
-A input_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 11 -j ACCEPT
-A input_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 12 -j ACCEPT
-A input_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 14 -j ACCEPT
-A input_int -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 18 -j ACCEPT
-A input_int -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INint-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INint-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INint-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INint-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 2 -j LOG --log-prefix "SFW2-INint-DROP-ICMP-CRIT " --log-tcp-options --log-ip-options
-A input_int -p icmp -j DROP
-A input_int -p tcp -m tcp --dport 113 --tcp-flags SYN,RST,ACK SYN -j reject_func
-A input_int -p tcp -m tcp --dport 11 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 11 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 15 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 15 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 21 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 23 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 111 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 389 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 515 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 515 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 631 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 873 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 873 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 2401 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 2401 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 5801 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 5801 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 5802 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 5802 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 5803 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 5803 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 5901 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 5901 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 5902 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 5902 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m tcp --dport 5903 --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m tcp --dport 5903 --tcp-flags SYN,RST,ACK SYN -j DROP
-A input_int -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-ACC-HiTCP " --log-tcp-options --log-ip-options
-A input_int -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_int -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A input_int -p udp -m udp --dport 11 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 15 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 21 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 22 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 23 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 69 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 111 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 389 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 389 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 515 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 631 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 873 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 1024 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 1025 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 2401 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 5801 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 5802 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 5803 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 5901 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 5902 -m state --state NEW -j DROP
-A input_int -p udp -m udp --dport 5903 -m state --state NEW -j DROP
-A input_int -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 4 -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 5 -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 8 -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 13 -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -p icmp -m icmp --icmp-type 17 -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -p udp -j LOG --log-prefix "SFW2-INint-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_int -m state --state INVALID -j LOG --log-prefix "SFW2-INint-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A input_int -j DROP
-A reject_func -p tcp -j REJECT --reject-with tcp-reset
-A reject_func -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject_func -j REJECT --reject-with icmp-proto-unreachable
COMMIT
# Completed on Thu Jul  5 02:52:47 2007
# Generated by iptables-save v1.2.9 on Thu Jul  5 02:52:47 2007
*nat
REROUTING ACCEPT [28699:3864027]
OSTROUTING ACCEPT [120:8728]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d 172.25.27.250 -p tcp -m tcp --dport 23 -j DNAT --to-destination 172.25.20.183
-A POSTROUTING -d 172.25.20.183 -p tcp -m tcp --dport 23 -j SNAT --to-source 172.25.27.250
COMMIT
# Completed on Thu Jul  5 02:52:47 2007

网络结构其实很简单  就是两个网段内的机器，相互间能访问 A:172.25.27.250 B:172.25.20.183,现在想 telnet 172.25.27.250 就直接登陆到172.25.20.183服务器

huang_bu

都是单网卡的机器，没有其他特别的设置了

kenduest

原帖由 huang_bu 于 2007-8-23 15:10 发表
都是单网卡的机器，没有其他特别的设置了

這樣無法 debug 吧 ?

清除所有 rule, 請用最乾淨的方式測試你的需求, 都可以工作後才依據你原本那堆 firewall rule 加上後續新增需求的設定

--