iptables防火墙——学会利用SNAT和DNAT 共享上网并发布内网服务器

[root@oo ~]# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ens33 -j SNAT --to-source 192.168.248.55

[root@ll ~]# iptables-save
# Generated by iptables-save v1.4.21 on Fri Dec 29 11:00:54 2023
*mangle
:PREROUTING ACCEPT [3174:3234919]
:INPUT ACCEPT [3174:3234919]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2410:326742]
:POSTROUTING ACCEPT [2452:331332]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Fri Dec 29 11:00:54 2023
# Generated by iptables-save v1.4.21 on Fri Dec 29 11:00:54 2023
*nat
:PREROUTING ACCEPT [30:2716]
:INPUT ACCEPT [30:2716]
:OUTPUT ACCEPT [190:14069]
:POSTROUTING ACCEPT [190:14069]
-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
COMMIT
# Completed on Fri Dec 29 11:00:54 2023
# Generated by iptables-save v1.4.21 on Fri Dec 29 11:00:54 2023
*filter
:INPUT ACCEPT [3176:3235096]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2413:327711]
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
COMMIT
# Completed on Fri Dec 29 11:00:54 2023
[root@ll ~]# 

[root@ll ~]# iptables-save > /opt/iprules_all.txt   //备份所有表的规则

[root@ll ~]# iptables-save > /etc/sysconfig/uptables
[root@oo ~]# systemctl enable iptables
[root@oo ~]# systemctl list-unit-files | grep iptables
iptables.service                              enabled 
[root@oo ~]# 

[root@oo ~]# systemctl start iptables
[root@oo ~]# service iptables start
Redirecting to /bin/systemctl start iptables.service
[root@oo ~]# 

[root@oo ~]# systemctl status iptables.service 
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since 五 2023-12-29 11:14:11 CST; 12s ago
  Process: 10637 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS)
 Main PID: 6629 (code=exited, status=0/SUCCESS)

12月 29 08:57:21 oo systemd[1]: Starting IPv4 firewall with iptables...
12月 29 08:57:21 oo iptables.init[6629]: iptables: Applying firewall rules: [  确定  ]
12月 29 08:57:21 oo systemd[1]: Started IPv4 firewall with iptables.
12月 29 11:14:11 oo systemd[1]: Stopping IPv4 firewall with iptables...
12月 29 11:14:11 oo iptables.init[10637]: iptables: Setting chains to policy ACCEPT:…  ]
12月 29 11:14:11 oo iptables.init[10637]: iptables: Flushing firewall rules: [  确定  ]
12月 29 11:14:11 oo iptables.init[10637]: iptables: Unloading modules: [  确定  ]
12月 29 11:14:11 oo systemd[1]: Stopped IPv4 firewall with iptables.
Hint: Some lines were ellipsized, use -l to show in full.
[root@oo ~]# 

[root@oo ~]# vim op.sh
INET_IF= "ens33"            //外网接口
INET_IP="192.168.248.55"     //外网接口地址 
LAN_IF="ens38"              //内网接口
LAN_IP= "192.168.31.144"     //内网接口地址
LAN_NET="192.168.31.0/24"      //内网网段
LAN_WWW_IP="192.168.1.6"      //网站服务器的内部地址
IPT="/sbin/iptables"          //iptables 命令的路径
MOD="/sbin/modprobe"          //modprobe 命令的路径
CTL="/sbin/sysctl"            //sysctl 命令的路径    

$MOD ip_tables //iptables 基本模块
$MOD ip_conntrack //连接跟踪模块
$MOD ipt_REJECT //拒绝操作模块
$MOD ipt_LOG //日志记录模块
$MOD ipt_iprange //支持 IP 范围匹配
$MOD xt_tcpudp //支持 TCP、UDP 协议
$MOD xt_state //支持状态匹配
$MOD xt_multiport //支持多端口匹配
$MOD xt_mac //支持 MAC 地址匹配
$MOD ip_nat_ftp //支持 FTP 地址转换
$MOD ip_conntrack_ftp //支持 FTP 连接跟踪

$IPT -t filter –X //删除各表中自定义的链
$IPT -t nat -X
$IPT -t mangle -X
$IPT -t raw -X
$IPT -t filter –F //清空各表中已有的规则
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t raw -F

$IPT -A FORWARD -s $LAN_NET -o $INET_IF -p udp --dport 53 -j ACCEPT
$IPT -A FORWARD -s $LAN_NET -o $INET_IF -p tcp --dport 80 -j ACCEPT
$IPT -A FORWARD -s $LAN_NET -o $INET_IF -p tcp --dport 20:21 -j ACCEPT
$IPT -A FORWARD -d $LAN_NET -i $INET_IF -m state --state ESTABLISHED, RELATED
-j ACCEPT

[root@oo ~]# vi /opt/myipfw.hostonly
#!/bin/bash
# 1. 定义基本变量
IPT="/sbin/iptables" CTL="/sbin/sysctl" # 2. 调整/proc 参数
$CTL -w net.ipv4.tcp_syncookies=1
$CTL -w net.ipv4.tcp_syn_retries=3
$CTL -w net.ipv4.tcp_synack_retries=3
$CTL -w net.ipv4.tcp_fin_timeout=60
$CTL -w net.ipv4.tcp_max_syn_backlog=3200
# 3. 设置具体的防火墙规则
# 3.1 删除自定义链、清空已有规则
$IPT -t filter -X
$IPT -t nat -X
$IPT -t mangle -X
$IPT -t raw -X
$IPT -t filter -F
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t raw -F
# 3.2 定义默认策略
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT
# 3.3 设置 filter 表中的各种规则
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT