NAT简单实例，教会你如何配置访问内部开发环境

来源：互联网发布：小蜜蜂写作软件编辑：程序博客网时间：2024/09/21 09:03

现在有另外内部开发网络需要访问特定外网，内部开发网络网段: 192.168.15.0/24

以下是设置NAT服务器。此服务器有一块网卡可以访问外网， ip为192.168.1.128

[root@isofficetest ~]#cat /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0

HWADDR=00:15:5D:01:7F:03

TYPE=Ethernet

UUID=2b42b57d-2746-4b76-b828-5eb5f50edef3

ONBOOT=yes

NM_CONTROLLED=yes

BOOTPROTO=dhcp

[root@isofficetest ~]# vi /etc/sysconfig/network-scripts/ifcfg-eth0:0

DEVICE='eth0:0'

ONBOOT=yes

BOOTPROTO=static

IPADDR=192.168.15.76

NETMASK=255.255.255.0

USERCTL=no

[root@isofficetest ~]# ifconfig -a

eth0 Link encap:Ethernet HWaddr 00:15:5D:01:7F:03

inet addr:192.168.1.128 Bcast:192.168.1.255 Mask:255.255.255.0

inet6 addr: fe80::215:5dff:fe01:7f03/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:90814 errors:0 dropped:0 overruns:0 frame:0

TX packets:8477 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:14130433 (13.4 MiB) TX bytes:1663260 (1.5 MiB)

eth0:0 Link encap:Ethernet HWaddr 00:15:5D:01:7F:03

inet addr:192.168.15.76 Bcast:192.168.15.255 Mask:255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

inet6 addr: ::1/128 Scope:Host

UP LOOPBACK RUNNING MTU:16436 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

[root@isofficetest ~]# netstat -rn

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

192.168.15.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0

0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0

[root@isofficetest ~]# cat nat.sh

#!/bin/bash

EXIF='eth0'

EXNET='192.168.15.0/24'

# 1. routing

echo 1 > /proc/sys/net/ipv4/ip_forward

/sbin/iptables -F

/sbin/iptables -X

/sbin/iptables -Z

/sbin/iptables -F -t nat

/sbin/iptables -X -t nat

/sbin/iptables -Z -t nat

/sbin/iptables -P INPUT ACCEPT

/sbin/iptables -P OUTPUT ACCEPT

/sbin/iptables -P FORWARD ACCEPT

/sbin/iptables -t nat -P PREROUTING ACCEPT

/sbin/iptables -t nat -P POSTROUTING ACCEPT

/sbin/iptables -t nat -P OUTPUT ACCEPT

# 2. 载入模组

/sbin/modprobe ip_tables 2> /dev/null

/sbin/modprobe ip_nat_ftp 2> /dev/null

/sbin/modprobe ip_nat_irc 2> /dev/null

/sbin/modprobe ip_conntrack 2> /dev/null

/sbin/modprobe ip_conntrack_ftp 2> /dev/null

/sbin/modprobe ip_conntrack_irc 2> /dev/null

# 3. 启动ip伪装

/sbin/iptables -t nat -A POSTROUTING -o $EXIF -s $EXNET -j MASQUERADE

[root@isofficetest ~]# service network restart

[root@isofficetest ~]# ./nat.sh

现在内部开发网络环境pc 192.168.15.77就可以访问外网啦。

[root@isofficetest3 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE='eth0'

ONBOOT=yes

BOOTPROTO=static

IPADDR=192.168.15.77

GATEWAY=192.168.15.76

NETMASK=255.255.255.0

USERCTL=no

[root@isofficetest3 ~]# ifconfig -a

eth0 Link encap:Ethernet HWaddr 00:15:5D:01:7F:05

inet addr:192.168.15.77 Bcast:192.168.15.255 Mask:255.255.255.0

inet6 addr: fe80::215:5dff:fe01:7f05/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:83951 errors:0 dropped:0 overruns:0 frame:0

TX packets:7267 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:11860195 (11.3 MiB) TX bytes:1076082 (1.0 MiB)

lo Link encap:Local Loopback

inet addr:127.0.0.1 Mask:255.0.0.0

inet6 addr: ::1/128 Scope:Host

UP LOOPBACK RUNNING MTU:16436 Metric:1

RX packets:409 errors:0 dropped:0 overruns:0 frame:0

TX packets:409 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:0

RX bytes:135770 (132.5 KiB) TX bytes:135770 (132.5 KiB)

[root@isofficetest3 ~]# ping www.baidu.com

PING www.a.shifen.com (14.215.177.38) 56(84) bytes of data.

64 bytes from 14.215.177.38: icmp_seq=1 ttl=54 time=6.30 ms

以下是设置只允许内部开放环境访问baidu网站。先禁用内部开发网络通过NAT 80 PORT出去外网, 然后再只允许访问百度80 PORT。

[root@isofficetest ~]# iptables -I FORWARD -p tcp --dport 80 -j DROP

[root@isofficetest ~]# iptables -I FORWARD -d www.baidu.com -p tcp --dport 80 -j ACCEPT

如果外部网络需要SSH登录内部开发环境服务器。做以下类似端口映射。

iptables -t nat -A PREROUTING -d 192.168.1.128 -p tcp -m tcp --dport 931 -j DNAT --to-destination 192.168.15.77:22

iptables -t nat -A PORTROUTING -s 192.168.0.0/255.255.0.0 -d 192.168.15.77 -p tcp -m tcp --dport 22 -j SNAT --to-source 192.168.1.128

此时你就可以putty访问192.168.1.128:931 来ssh登录内部开发网络环境的pc 192.168.15.77啦。

0 0