NAT使用实例

王朝other·作者佚名  2008-05-18
窄屏简体版  字體: |||超大  

#!/bin/sh

#####################################

# Example NAT usage for 2.4 kernels #

# Stephanie Lockwood-Childs 1/17/01 #

#####################################

#----------------------#

# Variable Definitions #

#----------------------#

EXT=eth0

INT=eth1

# "Masquerading" Example

PRIV_NETS="128.111.1.1 128.111.185.0/255.255.255.0"

MASQ_NET=192.168.1.0/255.255.255.0

# "General SNAT" Example

MAP_FROM=192.168.1.0/255.255.255.0

MAP_TO=128.111.185.30-128.111.185.42

# "Redirection" Example

INTERNAL_IP=10.10.1.1

# "Port Forwarding" Example

EXTERNAL_IP=128.111.1.200

NEWS_SERVER=10.10.1.38

MAIL_SERVER=10.10.1.69

# "Load Balancing" Example

VIRTUAL_SERVER=news.sblug.com

SERVER_RANGE=10.10.1.9-10.10.1.15

#-------------#

# NAT Section #

#-------------#

#

# Flush previous rules

#

iptables -t nat -F

#

# Masquerading

#

# Masquerading for outgoing connections, except privileged nets are exempt

for NET in $PRIV_NETS ; do

iptables -t nat -A POSTROUTING -d $NET -o $EXT -j ACCEPT

done

iptables -t nat -A POSTROUTING -s $MASQ_NET -o $EXT -j MASQUERADE

#

# General SNAT

#

# Internal computers w/ private ips "borrow" public ips of other internal computers to ssh out

iptables -t nat -A POSTROUTING -s $MAP_FROM -o $EXT -p tcp --dport ssh -j SNAT --to-source $MAP_TO

iptables -t nat -A POSTROUTING -s $MAP_FROM -o $EXT -p udp --dport ssh -j SNAT --to-source $MAP_TO

#

# Redirection

#

# Redirect internal net http traffic through squid proxy, but allow direct access to local web server

iptables -t nat -A PREROUTING -i $INT -d ! $INTERNAL_IP -p tcp --dport www -j REDIRECT --to-port 8080

#

# Port Forwarding

#

# Forward gateway port 7000 to news server and gateway port 8000 to pop mail server

iptables -t nat -A PREROUTING -d $EXTERNAL_IP -p tcp --dport 7000 -j DNAT --to-dest $NEWS_SERVER:nntp

iptables -t nat -A PREROUTING -d $EXTERNAL_IP -p tcp --dport 8000 -j DNAT --to-dest $MAIL_SERVER:pop3

#

# Load Balancing

#

# Basic load balancing by redirecting nntp requests to any of several local news servers

iptables -t nat -A PREROUTING -d $VIRTUAL_SERVER -p tcp --dport nntp -j DNAT --to-dest $SERVER_RANGE

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航