本地网络 >> 中转IP:183.60.100.8 >> 目标IP:103.79.78.76

温馨提示

如果是远程操作的话，请做好定时防火墙失效，防止自己连接不上。

每10分钟关闭防火墙

1 2	$ crontab -e #/10 * * * /data/shell/stop_ufw.sh

非常简单的代码

$ cat /data/shell/stop_ufw.sh 
#!/bin/bash
###Ubuntu
/usr/sbin/ufw disable
###Centos7
/usr/bin/systemctl stop iptables.service

环境说明

国外目标服务器IP: 103.79.78.76
国内中转服务器IP: 183.60.100.8

iptables 端口转发(CentOS)

注意：一来一去
在中转服务器操作

1
2

iptables -t nat -A PREROUTING -p tcp --dport [端口号] -j DNAT --to-destination [目标IP]
iptables -t nat -A POSTROUTING -p tcp -d [目标IP] --dport [端口号] -j SNAT --to-source [中转服务器IP]

开启ipv4转发

1 2	echo -e "net.ipv4.ip_forward=1" >> /etc/sysctl.conf sysctl -p

同端口转发(tcp+udp)

本地网络连接的端口是10010

$ iptables -t nat -A PREROUTING -p tcp --dport 10010 -j DNAT --to-destination 103.79.78.76
$ iptables -t nat -A PREROUTING -p udp --dport 10010 -j DNAT --to-destination 103.79.78.76
$ iptables -t nat -A POSTROUTING -p tcp -d 103.79.78.76 --dport 10010 -j SNAT --to-source 183.60.100.8
$ iptables -t nat -A POSTROUTING -p udp -d 103.79.78.76 --dport 10010 -j SNAT --to-source 183.60.100.8

不同端口转发

本地网络连接的端口依旧是10010，而不是10086

1
2

$ iptables -t nat -A PREROUTING -p tcp  -m tcp --dport 10010 -j DNAT --to-destination 103.79.78.76:10086
$ iptables -t nat -A POSTROUTING -p tcp  -m tcp -d 103.79.78.76 --dport 10086 -j SNAT --to-source 183.60.100.8

多端口转发

本地网络连接的端口是10000-10010

1
2

$ iptables -t nat -A PREROUTING -p tcp  -m tcp --dport 10000:10010 -j DNAT --to-destination 103.79.78.76
$ iptables -t nat -A POSTROUTING -p tcp  -m tcp -d 103.79.78.76 --dport 10000:10010 -j SNAT --to-source 183.60.100.8

保存iptables配置

1	service iptables save

删除NAT规则

删除第一个规则

1 2	iptables -t nat -D POSTROUTING 1 iptables -t nat -D PREROUTING 1

ufw端口转发(Ubuntu)

编辑 etc/default/ufw文件中更改参数DEFAULT_FORWARD_POLICY

1	default_forward_policy = "accept"

配置/etc/ufw/sysctl.conf 允许ipv4转发（默认情况下，参数被注释掉）。如果你想要ipv6取消注释。

1
2
3

net/ipv4/ip_forward=1
#net/ipv6/conf/default/forwarding=1
#net/ipv6/conf/all/forwarding=1

最后一步是添加NAT到/etc/ufw/before.rules的配置。将以下内容添加到过滤器规则（*filter）之前

# NAT Table rules #2017/10/11
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Port Forwardings 
-A PREROUTING -p tcp --dport 10010 -j DNAT --to-destination 103.79.78.76
-A POSTROUTING -p tcp -d 103.79.78.76 --dport 10010 -j SNAT --to-source 183.60.100.8

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

注意*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。

现在通过重新启动ufw启用更改。

1	sudo ufw disable && sudo ufw enable

查看iptables生效状态

在中转服务器查看

$ iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 3531 packets, 06K bytes)
 pkts bytes target     prot opt in     out     source               destination         
12103  33K DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:10010 to:103.79.78.76

Chain INPUT (policy ACCEPT 3372 packets, 97K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 970 packets, 52079 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 970 packets, 52079 bytes)
 pkts bytes target     prot opt in     out     source               destination         
12103  33K SNAT       tcp  --  any    any     anywhere             103.79.78.76         tcp dpt:10010 to:183.60.100.8

查看指定规则表状态
iptables -t nat -vnL POSTROUTING
iptables -t nat -vnL PREROUTING

查看连接状态

在目标服务器查看

$ lsof -i:10010
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
python  3187 root    3u  IPv4  26485      0t0  TCP *:10010 (LISTEN)
python  3187 root    4u  IPv4  26486      0t0  UDP *:10010 
python  3187 root    8u  IPv4  93464      0t0  TCP 103.79.78.76:10010->183.60.100.8:60835 (ESTABLISHED)
python  3187 root   10u  IPv4  93645      0t0  TCP 103.79.78.76:10010->183.60.100.8:60866 (ESTABLISHED)
python  3187 root   14u  IPv4  83358      0t0  TCP 103.79.78.76:10010->183.60.100.8:58893 (ESTABLISHED)
python  3187 root   15u  IPv4  92698      0t0  TCP 103.79.78.76:10010->183.60.100.8:60495 (ESTABLISHED)
python  3187 root   17u  IPv4  83360      0t0  TCP 103.79.78.76:10010->183.60.100.8:58898 (ESTABLISHED)

https://help.ubuntu.com/lts/serverguide/firewall.html#ip-masquerading

配置iptables、ufw端口转发