Iptables-linux服务器做路由转发

末蓝、 2022-05-22 08:43 309阅读 0赞

1.架构图

<table> 
 <tbody> 
 <tr> 
 <td><img src="https://img-blog.csdn.net/20180620160731579?watermark/2/text/aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpYW5nX29wZXJhdGlvbnM=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70" alt="">&nbsp;域网上网案例，实现内部服务器C可以经过服务器B进行上网。</td> 
 </tr> 
 </tbody> 
</table>

**2.局域网机器配置**

**3.服务器配置**

<table> 
 <tbody> 
 <tr> 
 <td>3.1服务器双网卡，一块配置外网IP，一块配置内网IP（内网的不要设置网关）[root@liang ~]# ip a1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN&nbsp;&nbsp;&nbsp;&nbsp;link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00&nbsp;&nbsp;&nbsp;&nbsp;inet 127.0.0.1/8 scope host lo&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft forever preferred_lft forever&nbsp;&nbsp;&nbsp;&nbsp;inet6 ::1/128 scope host&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft forever preferred_lft forever2: eno16777736: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000&nbsp;&nbsp;&nbsp;&nbsp;link/ether 00:0c:29:03:1e:48 brd ff:ff:ff:ff:ff:ff&nbsp;&nbsp;&nbsp;&nbsp;inet 192.168.1.19/24 brd 192.168.1.255 scope global eno16777736&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft forever preferred_lft forever3: eno33554976: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000&nbsp;&nbsp;&nbsp;&nbsp;link/ether 00:0c:29:03:1e:52 brd ff:ff:ff:ff:ff:ff&nbsp;&nbsp;&nbsp;&nbsp;inet 10.0.0.141/24 brd 10.0.0.255 scope global dynamic eno33554976&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft 1555sec preferred_lft 1555sec&nbsp;&nbsp;&nbsp;&nbsp;inet6 fe80::20c:29ff:fe03:1e52/64 scope link&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;valid_lft forever preferred_lft forever3.2确保服务器可以上网 &nbsp;&nbsp;&nbsp;[root@liang ~]# ping -c 2 baidu.comPING baidu.com (123.125.115.110) 56(84) bytes of data.64 bytes from 123.125.115.110: icmp_seq=1 ttl=128 time=45.9 ms64 bytes from 123.125.115.110: icmp_seq=2 ttl=128 time=45.8 ms&nbsp;--- baidu.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 1002msrtt min/avg/max/mdev = 45.807/45.860/45.913/0.053 ms&nbsp;3.3在内核文件/etc/sysctl.conf里开启转发功能，然后执行sysctl -p生效[root@liang ~]# tail -1 /etc/sysctl.conf &nbsp;net.ipv4.ip_forward = 1&nbsp;[root@liang ~]# sysctl -pnet.ipv4.ip_forward = 1&nbsp;3.4配置iptables[root@liang ~]# iptables -F[root@liang ~]# iptables -P INPUT ACCEPT[root@liang ~]# iptables -P FORWARD ACCEPT[root@liang ~]# iptables -P OUTPUT ACCEPT3.5路由转发[root@liang ~]# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \-o eno33554976 -j SNAT --to-source 10.0.0.141&nbsp;-s 192.168.1.0/24 内部服务器网段-o eno33554976 为路由转发服务器的外网网卡-j SNAT --to-source 10.0.0.141 外网网卡IP地址iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE （伪装，适合外网IP地址变化的配置）&nbsp;</td> 
 </tr> 
 </tbody> 
</table>

**4.测试：**

笔记来源于：老男孩培训机构教育视频