{"id":138,"date":"2018-06-05T15:43:21","date_gmt":"2018-06-05T07:43:21","guid":{"rendered":"http:\/\/www.cloudy.pub\/?p=138"},"modified":"2018-06-05T15:43:21","modified_gmt":"2018-06-05T07:43:21","slug":"%e5%a6%82%e4%bd%95%e8%ae%be%e7%bd%ae%e6%9c%8d%e5%8a%a1%e5%99%a8%e4%b8%ad%e8%bd%ac-%e5%88%a9%e7%94%a8-iptables-firewalld","status":"publish","type":"post","link":"https:\/\/www.0moon.com\/?p=138","title":{"rendered":"\u5982\u4f55\u8bbe\u7f6e\u670d\u52a1\u5668\u4e2d\u8f6c &#8211; \u5229\u7528 iptables\/firewalld"},"content":{"rendered":"<h2 id=\"article-header-0\">\u4e00\u3001\u5b9a\u4e49<\/h2>\n<p>\u4e2d\u8f6c\uff0c\u987e\u540d\u601d\u4e49\uff0c\u5c31\u662f\u7528\u4e00\u53f0\u4f18\u8d28\u4e2d\u8f6c\u670d\u52a1\u5668\u4e2d\u8f6c\u76ee\u7684\u670d\u52a1\u5668\uff0c\u4f18\u5316\u7528\u6237\u7aef\u5230\u76ee\u7684\u670d\u52a1\u5668\u7684\u94fe\u8def\uff0c\u5f62\u6210\u00a0<strong>\u7528\u6237 \u2192 \u56fd\u5185\u4e2d\u8f6c\u670d\u52a1\u5668 \u2192 \u76ee\u7684\u5730\u670d\u52a1\u5668<\/strong>\u00a0\u7684\u7f51\u8def\u94fe\u8def\uff0c\u7b80\u5355\u6765\u8bf4\u5c31\u662f\u901a\u8fc7\u4e2d\u8f6c\u670d\u52a1\u5668\u4f18\u5316\u7528\u6237\u7aef\u5230\u76ee\u7684\u670d\u52a1\u5668\u7684\u8def\u7531\u3002<\/p>\n<h2 id=\"article-header-1\">\u4e8c\u3001\u610f\u4e49<\/h2>\n<p>\u67d0\u4e9b\u8fd0\u8425\u5546\uff0c\u6bd4\u5982\u957f\u57ce\u5bbd\u5e26\u3001\u9e4f\u535a\u58eb\u5bbd\u5e26\u8fd9\u79cd\u4e8c\u7ea7\u8fd0\u8425\u5546\uff0c\u81ea\u5df1\u6ca1\u6709\u51fa\u53e3\u5e26\u5bbd\uff0c\u9760\u79df\u4e0a\u7ea7\u8fd0\u8425\u5546\u7684\u5e26\u5bbd\u8fc7\u6d3b\uff0c\u4eba\u4e00\u591a\u5c31\u62e5\u6324\u3002\u5373\u4fbf\u662f\u7535\u4fe1\u3001\u8054\u901a\u3001\u79fb\u52a8\u8fd9\u4e09\u5927\u8fd0\u8425\u5546\uff0c\u6c11\u7528\u7ea7\u7684\u56fd\u9645\u51fa\u53e3\u5e26\u5bbd\u5728\u9ad8\u5cf0\u65f6\u4e5f\u5982\u540c\u4e07\u4eba\u6324\u72ec\u6728\u6865\uff0c\u975e\u5e38\u62e5\u5835\uff0c\u5bfc\u81f4\u5927\u5bb6\u5e73\u5e38\u73a9\u6e38\u620f\u65f6\u7ecf\u5e38\u9047\u5230\u9ad8\u5ef6\u8fdf\u3001\u9ad8\u4e22\u5305\u7684\u73b0\u8c61\u3002\u76f8\u5bf9\u7684\uff0cBGP \u7ebf\u8def\u5c31\u4f1a\u5bbd\u677e\u5f88\u591a\uff0c\u5229\u7528\u4e2d\u8f6c\uff0c\u7528\u6237\u7aef\u53ef\u4ee5\u76f4\u63a5\u4ece\u56fd\u5185\u8d70\u4f01\u4e1a\u7ea7\u56fd\u9645\u51fa\u53e3\uff0c<strong>\u76f8\u5f53\u4e8e\u51fa\u56fd\u7684 VIP \u7eff\u8272\u901a\u9053<\/strong>\uff0c\u907f\u514d\u548c\u522b\u4eba\u4e89\u90a3\u4e2a\u672c\u6765\u5c31\u4e0d\u591a\u7684\u6c11\u7528\u51fa\u53e3\uff0c\u5927\u5927\u964d\u4f4e\u5ef6\u8fdf\u548c\u4e22\u5305\u3002<\/p>\n<h2 id=\"article-header-2\">\u4e09\u3001\u8bbe\u7f6e<\/h2>\n<p>\u4e3b\u8981\u662f\u4e2d\u8f6c\u670d\u52a1\u5668\u7684\u8bbe\u7f6e\uff0c\u7cfb\u7edf\u4e0d\u4e00\u6837\u6b65\u9aa4\u53ef\u80fd\u4e0d\u540c\uff0c\u8fd9\u91cc\u4ee5 Ubuntu 16.04 \u4e3a\u4f8b\uff0c\u5927\u5bb6\u53ef\u4ee5\u6839\u636e\u81ea\u5df1\u7684\u7cfb\u7edf\u76f8\u5e94\u4fee\u6539\u3002<\/p>\n<p>\u4e2d\u8f6c\u6548\u679c\u53d7\u4e2d\u8f6c\u670d\u52a1\u5668\u7684\u8d28\u91cf\u5f71\u54cd\uff0c\u6bd4\u5982\u4e2d\u8f6c\u670d\u52a1\u5668\u5e26\u5bbd\u4e3a 1Mbps\uff0c\u90a3\u4e48\u4e2d\u8f6c\u4e4b\u540e\uff0c\u7528\u6237\u7aef\u5230\u76ee\u7684\u670d\u52a1\u5668\u7684\u6700\u9ad8\u901f\u5ea6\u4e5f\u4e0d\u4f1a\u8d85\u8fc7 1Mbps\uff0c\u56e0\u6b64\u00a0<strong>\u5c3d\u91cf\u627e\u4e00\u53f0\u8d28\u91cf\u597d\u7684\u4e2d\u8f6c\u670d\u52a1\u5668<\/strong>\u3002<\/p>\n<h3 id=\"article-header-3\">1\u3001\u5f00\u542f\u8f6c\u53d1\u529f\u80fd<\/h3>\n<pre><code class=\"lang-sh hljs bash\">$ sudo vim \/etc\/sysctl.conf<\/code><\/pre>\n<p>\u5220\u9664\u00a0<code>net.ipv4.ip_forward=1<\/code>\u00a0\u524d\u7684\u6ce8\u91ca\u7b26\u53f7\u00a0<code>#<\/code>\uff0c\u5982\u679c\u652f\u6301 IPv6\uff0c\u5219\u5e94\u4e00\u5e76\u5220\u9664\u00a0<code>net.ipv6.conf.all.forwarding=1<\/code>\u524d\u7684\u6ce8\u91ca\u7b26\u53f7\u00a0<code>#<\/code>\uff0c\u4fee\u6539\u540e\u5927\u81f4\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\">......\r\n<span class=\"hljs-comment\"># Uncomment the next line to enable packet forwarding for IPv4<\/span>\r\nnet.ipv4.ip_forward=1\r\n\r\n<span class=\"hljs-comment\"># Uncomment the next line to enable packet forwarding for IPv6<\/span>\r\n<span class=\"hljs-comment\">#  Enabling this option disables Stateless Address Autoconfiguration<\/span>\r\n<span class=\"hljs-comment\">#  based on Router Advertisements for this host<\/span>\r\nnet.ipv6.conf.all.forwarding=1\r\n......<\/code><\/pre>\n<p>\u8fd0\u884c\u547d\u4ee4\u4f7f\u5176\u751f\u6548\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\">$ sudo sysctl -p<\/code><\/pre>\n<h3 id=\"article-header-4\">2\u3001\u8bbe\u7f6e iptables \u8f6c\u53d1<\/h3>\n<pre><code class=\"lang-sh hljs bash\">$ sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport [\u672c\u5730\u7aef\u53e3] -j DNAT --to-destination [\u76ee\u7684IP]:[\u76ee\u7684\u7aef\u53e3]\r\n$ sudo iptables -t nat -A PREROUTING -p udp -m udp --dport [\u672c\u5730\u7aef\u53e3] -j DNAT --to-destination [\u76ee\u7684IP]:[\u76ee\u7684\u7aef\u53e3]\r\n$ sudo iptables -t nat -A POSTROUTING -p tcp -m tcp <span class=\"hljs-_\">-d<\/span> [\u76ee\u7684IP] --dport [\u76ee\u7684\u7aef\u53e3] -j SNAT --to-source [\u672c\u5730IP]\r\n$ sudo iptables -t nat -A POSTROUTING -p udp -m udp <span class=\"hljs-_\">-d<\/span> [\u76ee\u7684IP] --dport [\u76ee\u7684\u7aef\u53e3] -j SNAT --to-source [\u672c\u5730IP]\r\n$ sudo iptables-save &gt; \/etc\/iptables.up.rules<\/code><\/pre>\n<p>\u6ce8\u610f\u70b9\uff1a<br \/>\n\u2460 \u672c\u5730IP\uff1a\u5982\u679c\u6709\u79c1\u7f51\uff0c\u5219\u5e94\u586b\u79c1\u7f51 IP\uff0c\u5426\u5219\u76f4\u63a5\u586b\u516c\u7f51 IP\uff1b<br \/>\n\u2461 \u672c\u5730\u7aef\u53e3\uff1a\u4e2d\u8f6c\u670d\u52a1\u5668\u7684\u7aef\u53e3\uff1b<\/p>\n<h3 id=\"article-header-5\">3\u3001\u9a8c\u8bc1<\/h3>\n<p>\u5c06\u670d\u52a1\u5668 IP \u53ca\u7aef\u53e3\u4fee\u6539\u6210\u4e2d\u8f6c\u670d\u52a1\u5668\u7684 IP \u53ca\u7aef\u53e3\uff0c\u5176\u4ed6\u53c2\u6570\u4e0d\u53d8\u3002<\/p>\n<h3 id=\"article-header-6\">4\u3001\u6269\u5c55\u4e00\uff1a\u67e5\u770b\u53ca\u5220\u9664<\/h3>\n<p>\u2460 \u67e5\u770b\u5df2\u8bbe\u7f6e\u7684 NAT \u89c4\u5219\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\">$ sudo iptables -t nat -vnL POSTROUTING --line-number \r\n$ sudo iptables -t nat -vnL PREROUTING --line-number <\/code><\/pre>\n<p>\u2461 \u5220\u9664 NAT \u89c4\u5219\u4e2d POSTROUTING \u7684\u7b2c\u4e00\u6761\u89c4\u5219\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\">$ sudo iptables -t nat -D POSTROUTING 1<\/code><\/pre>\n<p>\u2462 \u6e05\u7a7a NAT \u89c4\u5219\u4e2d POSTROUTING \u6240\u6709\u89c4\u5219\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\">$ sudo iptables -t nat -F POSTROUTING<\/code><\/pre>\n<p>\u2463 \u5c06\u672c\u5730\u670d\u52a1\u5668\u7684 50000~65535 \u8f6c\u53d1\u81f3\u76ee\u6807 IP \u4e3a 1.1.1.1 \u7684 50000~65535 \u7aef\u53e3\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\">$ sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 50000:65535 -j DNAT --to-destination 1.1.1.1\r\n$ sudo iptables -t nat -A POSTROUTING <span class=\"hljs-_\">-d<\/span> 1.1.1.1\/32 -p tcp -m tcp --dport 50000:65535 -j SNAT --to-source [\u672c\u5730IP]<\/code><\/pre>\n<h3 id=\"article-header-7\">5\u3001\u6269\u5c55\u4e8c\uff1aCentOS7 \u5229\u7528 firewalld \u4e2d\u8f6c<\/h3>\n<p>CentOS7 \u5efa\u8bae\u4f7f\u7528\u81ea\u5e26\u7684 Firewall \u8bbe\u7f6e\u4e2d\u8f6c\uff08\u4f7f\u7528 iptables \u91cd\u542f\u53ef\u80fd\u4f1a\u5931\u6548\uff09\uff0c\u9996\u5148\u540c\u6837\u542f\u7528\u8f6c\u53d1\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\"><span class=\"hljs-comment\"># echo 1 &gt; \/proc\/sys\/net\/ipv4\/ip_forward<\/span><\/code><\/pre>\n<p>\u7136\u540e\u6dfb\u52a0\u9632\u706b\u5899 firewalld \u89c4\u5219\uff1a<\/p>\n<pre><code class=\"lang-sh hljs bash\"><span class=\"hljs-comment\"># firewall-cmd --permanent --add-port=2333\/tcp<\/span>\r\n<span class=\"hljs-comment\"># firewall-cmd --permanent --add-port=2333\/udp<\/span>\r\n<span class=\"hljs-comment\"># firewall-cmd --permanent --add-masquerade<\/span>\r\n<span class=\"hljs-comment\"># firewall-cmd --permanent --add-forward-port=port=2333:proto=tcp:toport=6666:toaddr=1.1.1.1<\/span>\r\n<span class=\"hljs-comment\"># firewall-cmd --permanent --add-forward-port=port=2333:proto=udp:toport=6666:toaddr=1.1.1.1<\/span>\r\n<span class=\"hljs-comment\"># firewall-cmd --reload<\/span><\/code><\/pre>\n<p>\u5176\u4e2d\uff0c2333 \u4ee3\u8868\u672c\u5730\u7aef\u53e3\uff0c 6666 \u8868\u793a\u76ee\u7684\u7aef\u53e3\uff0c 1.1.1.1 \u8868\u793a\u76ee\u7684 IP\uff0c\u5982\u679c\u76ee\u7684 IP \u6216\u76ee\u7684\u7aef\u53e3\u76f8\u540c\uff0c\u5219 toaddr \u6216 toport \u53ef\u7701\u7565\u3002<\/p>\n<p>&nbsp;<\/p>\n<p>\u8f6c\u8f7d\u81ea\uff1ahttps:\/\/blog.vircloud.net\/operations\/linux-transit.html<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4e00\u3001\u5b9a\u4e49 \u4e2d\u8f6c\uff0c\u987e\u540d\u601d\u4e49\uff0c\u5c31\u662f\u7528\u4e00\u53f0\u4f18\u8d28\u4e2d\u8f6c\u670d\u52a1\u5668\u4e2d\u8f6c\u76ee\u7684\u670d\u52a1\u5668\uff0c\u4f18\u5316\u7528\u6237\u7aef\u5230\u76ee\u7684\u670d\u52a1\u5668\u7684\u94fe\u8def\uff0c\u5f62\u6210\u00a0\u7528\u6237 \u2192 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,13],"tags":[45],"class_list":["post-138","post","type-post","status-publish","format-standard","hentry","category-linux","category-study","tag-45"],"_links":{"self":[{"href":"https:\/\/www.0moon.com\/index.php?rest_route=\/wp\/v2\/posts\/138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.0moon.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.0moon.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.0moon.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.0moon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=138"}],"version-history":[{"count":1,"href":"https:\/\/www.0moon.com\/index.php?rest_route=\/wp\/v2\/posts\/138\/revisions"}],"predecessor-version":[{"id":139,"href":"https:\/\/www.0moon.com\/index.php?rest_route=\/wp\/v2\/posts\/138\/revisions\/139"}],"wp:attachment":[{"href":"https:\/\/www.0moon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.0moon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.0moon.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}