iptables -t nat -A PREROUTING -d 10.85.10.164 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.122.46:3389
iptables -t nat -A POSTROUTING -s 192.168.122.0/255.255.255.0 -d 192.168.122.46 -p tcp -m tcp --dport 3389 -j SNAT --to-source 10.85.10.164
-A PREROUTING -i eth1 -p tcp -d 221.222.111.10 --dport 80 -j DNAT --to-destination 192.168.0.200:80
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -j SNAT --to 221.222.111.10
iptables -t nat -A PREROUTING -p tcp -d 10.85.10.164 --dport 3389 -j DNAT --to-destination 192.168.122.46:3389
iptables -t nat -A POSTROUTING -s 192.168.122.46/255.255.255.0 -j SNAT --to 10.85.10.164
iptables -A INPUT -p tcp --dport 3389 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -m tcp -d 10.85.10.164 --dport 8889 -j DNAT --to-destination 192.168.122.46:3389
iptables -t nat -A POSTROUTING -p tcp -m tcp -d 192.168.122.46 --dport 3389 -j SNAT --to 10.85.10.164
iptables -F
iptables -X
iptables -Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
8、转发本网段的机器到任何地方去的包：iptables -A FORWARD -s 172.16.3.0/24 -j ACCEPT
9、对先前从防火墙外部接口出去的请求包的回复：iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
10、打开IP伪装能：iptables -t nat -A POSTROUTING -o eth0 -s 172.16.3.0/24 -j MASQUERADE
11、目标端口为80的包可以进入：iptables -A INPUT -p tcp -i eth0 --syn --dport 80 -j ACCEPT
12、拒绝不是目标端口是80的所求TCP新的连接请求包：iptables -A INPUT -p tcp -i eth0 --syn -j DROP
13、工作站的IP地址设为：172.16.3.* 掩码：255.255.255.0网关:172.16.3.254
这样，工作站用户即使不设置任何代理，也同样可以上网。
iptables -A FORWARD -s 192.168.122.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.122.0/24 -j MASQUERADE
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
## nat Table
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.10.0/24 -j MASQUERADE
iptables -A INPUT -i virbr0 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 192.168.122.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.122.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.122.0/24 -o eth0 -j SNAT --to 10.85.10.164
阅读(508) | 评论(0) | 转发(0) |
