通过iptables实现NAT网络地址转换

内核配置
#
# IP: Netfilter Configuration
#
CONFIG_NF_DEFRAG_IPV4=m
CONFIG_NF_CONNTRACK_IPV4=m
CONFIG_NF_CONNTRACK_PROC_COMPAT=y
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_RPFILTER=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_TARGET_ULOG=m
CONFIG_NF_NAT_IPV4=m
CONFIG_IP_NF_TARGET_MASQUERADE=m
CONFIG_IP_NF_TARGET_NETMAP=m
CONFIG_IP_NF_TARGET_REDIRECT=m
CONFIG_NF_NAT_SNMP_BASIC=m
CONFIG_NF_NAT_PROTO_GRE=m
CONFIG_NF_NAT_PPTP=m
CONFIG_NF_NAT_H323=m
CONFIG_IP_NF_MANGLE=m
CONFIG_IP_NF_TARGET_CLUSTERIP=m
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
CONFIG_IP_NF_ARPTABLES=m
CONFIG_IP_NF_ARPFILTER=m
CONFIG_IP_NF_ARP_MANGLE=m


insmod /lib/modules/3.10.101/kernel/net/netfilter/x_tables.ko
insmod /lib/modules/3.10.101/kernel/net/ipv4/netfilter/ip_tables.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/nf_conntrack.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/nf_nat.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/nfnetlink.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/xt_nat.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/nf_conntrack_ftp.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/nf_nat_ftp.ko
insmod /lib/modules/3.10.101/kernel/net/ipv4/netfilter/nf_defrag_ipv4.ko
insmod /lib/modules/3.10.101/kernel/net/ipv4/netfilter/nf_conntrack_ipv4.ko
insmod /lib/modules/3.10.101/kernel/net/netfilter/nf_conntrack_netlink.ko
insmod /lib/modules/3.10.101/kernel/net/ipv4/netfilter/ipt_MASQUERADE.ko
insmod /lib/modules/3.10.101/kernel/net/ipv4/netfilter/nf_nat_ipv4.ko
insmod /lib/modules/3.10.101/kernel/net/ipv4/netfilter/iptable_filter.ko

setenv("XTABLES_LIBDIR","/lib/xtables",1);
system("echo 1 > /proc/sys/net/ipv4/ip_forward");

system("/sbin/iptables -F");
system("/sbin/iptables -X");
system("/sbin/iptables -Z");
system("/sbin/iptables -F -t nat");
system("/sbin/iptables -X -t nat");
system("/sbin/iptables -Z -t nat");
system("/sbin/iptables -P INPUT   ACCEPT");
system("/sbin/iptables -P OUTPUT  ACCEPT");
system("/sbin/iptables -P FORWARD ACCEPT");
system("/sbin/iptables -t nat -P PREROUTING  ACCEPT");
system("/sbin/iptables -t nat -P POSTROUTING ACCEPT");
system("/sbin/iptables -t nat -P OUTPUT      ACCEPT");

/sbin/iptables -t nat -A POSTROUTING -o ppp0 -s 192.168.1.10 -j MASQUERADE
/sbin/iptables -t nat -A PREROUTING -i ppp0 -s 10.2.1.3 -j DNAT --to-destination 192.168.1.10