本文共 2461 字，大约阅读时间需要 8 分钟。
企业实战使用
实战环境
CU:
ifconfig eth0 202.106.0.20 netmask 255.255.255.0
Client:
ifconfig eth0 192.168.0.1 netmask 255.255.255.0
route add default gw 192.168.0.254
Firewall:
ifconfig eth0 202.106.0.254 netmask 255.255.255.0
ifconfig eth1 192.168.0.254 netmask 255.255.255.0
service iptables stop
modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 –o eth0 -j SNAT --to 202.106.0.254
实战二
CU:
ifconfig eth0 202.106.0.20 netmask 255.255.255.0
Server:
ifconfig eth0 172.17.0.1 netmask 255.255.255.0
route add default gw 172.17.0.254
Client:
ifconfig eth0 192.168.0.1 netmask 255.255.255.0
route add default gw 192.168.0.254
Firewall:
ifconfig eth0 202.106.0.254 netmask 255.255.255.0
ifconfig eth1 192.168.0.254 netmask 255.255.255.0
ifconfig eth2 172.17.0.254 netmask 255.255.255.0
service iptables stop
modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 –o eth0 -j SNAT --to 202.106.0.254
iptables -t nat -A PREROUTING -d 202.106.0.254 -p tcp -dport 80 -j DNAT --to 172.17.0.1
iptables -A FORWARD -i eth2 -o eth1 -m state --state NEW -j DROP
CU:
ifconfig eth0 202.106.0.20 netmask 255.255.255.0
Server:
ifconfig eth0 172.17.0.1 netmask 255.255.255.0
route add default gw 172.17.0.254
Client:
ifconfig eth0 192.168.0.1 netmask 255.255.255.0
route add default gw 192.168.0.254
Firewall:
ifconfig eth0 202.106.0.254 netmask 255.255.255.0
ifconfig eth1 192.168.0.254 netmask 255.255.255.0
ifconfig eth2 172.17.0.254 netmask 255.255.255.0
service iptables stop
modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 –o eth0 -j SNAT --to 202.106.0.254
iptables -t nat -A PREROUTING -d 202.106.0.254 -p tcp -dport 80 -j DNAT --to 172.17.0.1
iptables -A FORWARD -i eth2 -o eth1 -m state --state NEW -j DROP