【已解决】关于Centos下KVM iptables端口转发的问题

xqcool8

现在我配了这3条命令，但是还是不通，就是访问外网IP的8000端口，转向虚拟机的22端口

iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
iptables -t nat -A PREROUTING -d 122.112.5.63 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 192.168.122.100:22
iptables -t nat -A POSTROUTING -s 192.168.122.0/255.255.255.0 -d 192.168.122.100 -p tcp -m tcp --dport 22 -j SNAT --to-source 192.168.122.1

xqcool8

回复 10# chenyx


转发是已经打开了

vi /etc/sysctl.conf
net.ipv4.ip_forward=1
   

xqcool8

我发现我的命令怎么加不到 /etc/sysconfig/iptables 文件里呢，加完后保存退出，在进去怎么就没了呢

xqcool8

只要我一重启 service iptables restart  配置文件就变回去了

xqcool8

现在保存了，还是不通，我贴一下，物理机上的/etc/sysconfig/iptables的配置信息，红色的是后加上的
# Generated by iptables-save v1.4.7 on Thu Aug  7 23:46:55 2014
*nat
REROUTING ACCEPT [1:72]
OSTROUTING ACCEPT [6:478]
:OUTPUT ACCEPT [7:538]
-A PREROUTING -d 122.112.5.63/32 -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.122.100:22
-A POSTROUTING -s 192.168.122.0/24 -d 192.168.122.100/32 -p tcp -m tcp --dport 22 -j SNAT --to-source 192.168.122.1
# Generated by iptables-save v1.4.7 on Thu Aug  7 23:46:55 2014
*nat
REROUTING ACCEPT [1:72]
OSTROUTING ACCEPT [6:478]
:OUTPUT ACCEPT [7:538]
-A PREROUTING -d 122.112.4.136/32 -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.122.100:22
-A POSTROUTING -s 192.168.122.0/24 -d 192.168.122.100/32 -p tcp -m tcp --dport 22 -j SNAT --to-source 192.168.122.1
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
COMMIT
# Completed on Thu Aug  7 23:46:55 2014
# Generated by iptables-save v1.4.7 on Thu Aug  7 23:46:55 2014
*mangle
REROUTING ACCEPT [288:23301]
:INPUT ACCEPT [283:22990]
:FORWARD ACCEPT [5:311]
:OUTPUT ACCEPT [222:27079]
OSTROUTING ACCEPT [224:27246]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Thu Aug  7 23:46:55 2014
# Generated by iptables-save v1.4.7 on Thu Aug  7 23:46:55 2014
*filter
:INPUT ACCEPT [283:22990]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [222:27079]
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 161 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Thu Aug  7 23:46:55 2014

xqcool8

还是不通啊

xqcool8

终于搞定了，最后就多了这2条命令


iptables -t nat -A PREROUTING -i eth+ -p tcp -m tcp --dport 2222 -j DNAT --to-destination 192.168.122.100:22

iptables -A FORWARD -d 192.168.122.100/32 -i eth+ -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

chenyx

解决了就好。
主要是Forward链没有访问相应端口的规则

niao5929

咋解决的哦。求解决方案