[转帖]ubuntu下配置iptables、ufw端口转发

iptables 端口转发(CentOS)

注意：一来一去
在中转服务器操作

iptables -t nat -A PREROUTING -p tcp --dport [端口号] -j DNAT --to-destination [目标IP]





iptables -t nat -A POSTROUTING -p tcp -d [目标IP] --dport [端口号] -j SNAT --to-source [中转服务器IP]

不同端口转发

本地网络连接的端口依旧是10010，而不是10086

$ iptables -t nat -A PREROUTING -p tcp  -m tcp --dport 10010 -j DNAT --to-destination 103.79.78.76:10086





$ iptables -t nat -A POSTROUTING -p tcp  -m tcp -d 103.79.78.76 --dport 10086 -j SNAT --to-source 183.60.100.8

ufw端口转发(Ubuntu)

编辑 etc/default/ufw文件中更改参数DEFAULT_FORWARD_POLICY

1	default_forward_policy = "accept"

配置/etc/ufw/sysctl.conf 允许ipv4转发（默认情况下，参数被注释掉）。如果你想要ipv6取消注释。

1 2 3

net/ipv4/ip_forward=1 #net/ipv6/conf/default/forwarding=1 #net/ipv6/conf/all/forwarding=1

最后一步是添加NAT到/etc/ufw/before.rules的配置。将以下内容添加到过滤器规则（*filter）之前

1 2 3 4 5 6 7 8 9 10 11

# NAT Table rules #2017/10/11 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] Port Forwardings -A PREROUTING -p tcp --dport 10010 -j DNAT --to-destination 103.79.78.76 -A POSTROUTING -p tcp -d 103.79.78.76 --dport 10010 -j SNAT --to-source 183.60.100.8 don't delete the 'COMMIT' line or these rules won't be processed COMMIT

注意*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。

现在通过重新启动ufw启用更改。

1	sudo ufw disable && sudo ufw enable

查看iptables生效状态

在中转服务器查看:

iptables -t nat -L -v

///

ubuntu下的ufw

ubuntu为了方面使用对底层的iptables做了一层配置简化，底层机制还是iptables,通过iptables可以请求实现端口映射、nat等，下面对ufw的配置做描述

安装: sudo apt install ufw

启动: sudo ufw ebable

停止: sudo ufw disable

状态: sudo ufw status

重载：sudo ufw reload

主要配置文件：

1、/etc/default/ufw

2、/etc/ufw/sysctl.conf

3、/etc/ufw/before.rules

说明：

1、ufw默认是将filter的input设置成了DROP，也就是说如果开启防火墙，默认情况下外部不能主动访问该节点了，所有需要修改INPUT策略，可以直接将 DEFAULT_INPUT_POLICY设置为ACCEPT

2、除了用 ufw命令或上面的配置文件外，原来的iptables命令也同样是有效的，实际上ufw的配置规则和iptables基本也一样

配置端口映射举例，

例如将8554映射到192.168.4.99:554，

本机的对外口为192.168.35.50，内网为192.168.4.102

方法一：iptables配置:

sudo iptables -t nat -A PREROUTING -p tcp --dport 8554 -j DNAT --to-destination 192.168.4.99:554

sudo iptables -t nat -A POSTROUTING -d 192.168.4.99 -p tcp --dport 554 -j SNAT --to-source 192.168.4.102

sudo iptables -A FORWARD -j ACCEPT

将net/ipv4/ip_forward设置为1

方法二：ufw配置

1、/etc/ufw/sysctl.conf中将net/ipv4/ip_forward设置为1

2、/etc/default/ufw中将DEFAULT_INPUT_POLICY设置为ACCEPT

3、/etc/default/ufw中将DEFAULT_FORWARD_POLICY设置为ACCEPT

4、修改/etc/ufw/before.rules，添加nat规则，在最后添加

*nat

:PREROUTING - [0:0]

:POSTROUTING - [0:0]

-A PREROUTING -p tcp --dport 8554 -j DNAT --to-destination 192.168.4.99:554

-A POSTROUTING -d 192.168.4.99 -p tcp --dport 554 -j SNAT --to-source 192.168.4.102

COMMIT

///

/// 91V 代理从机网页方法 ///

本地网络 >> 中转IP:192.168.44.100 >> 目标IP:1192.168.44.101

//参考链接：https://blog.csdn.net/maxuearn/article/details/104824898

*nat

:PREROUTING - [0:0]

:POSTROUTING - [0:0]

-A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.44.101:80

-A PREROUTING -p tcp --dport 6692 -j DNAT --to-destination 192.168.44.101:6692

-A POSTROUTING -p tcp -d 192.168.44.101 --dport 80 -j SNAT --to-source 192.168.44.100

-A POSTROUTING -p tcp -d 192.168.44.101 --dport 6692 -j SNAT --to-source 192.168.44.100

COMMIT

注意事项：

（1）*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。

（2）配置完成，需要通过重新启动ufw启用更改，使之生效。

sudo ufw disable && sudo ufw enable

（3）GEAC91V，从机需要修改net.xml配置文件中的websocket通信端口号，6691->6692, web页面中的通信端口号也要同步修改：6691->6692

路径：cd /usr/local/mec/www/src/views/mec/js

/ 以下为修改后的 before.rules 内容///

#





# rules.before





#





# Rules that should be run before the ufw command line added rules. Custom





# rules should be added to one of these chains:





#   ufw-before-input





#   ufw-before-output





#   ufw-before-forward





#





 





# Don't delete these required lines, otherwise there will be errors





*filter





:ufw-before-input - [0:0]





:ufw-before-output - [0:0]





:ufw-before-forward - [0:0]





:ufw-not-local - [0:0]





# End required lines





 





 





# allow all on loopback





-A ufw-before-input -i lo -j ACCEPT





-A ufw-before-output -o lo -j ACCEPT





 





# quickly process packets for which we already have a connection





-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT





-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT





-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT





 





# drop INVALID packets (logs these in loglevel medium and higher)





-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny





-A ufw-before-input -m conntrack --ctstate INVALID -j DROP





 





# ok icmp codes for INPUT





-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT





-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT





-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT





-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT





 





# ok icmp code for FORWARD





-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT





-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT





-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT





-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT





 





# allow dhcp client to work





-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT





 





#





# ufw-not-local





#





-A ufw-before-input -j ufw-not-local





 





# if LOCAL, RETURN





-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN





 





# if MULTICAST, RETURN





-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN





 





# if BROADCAST, RETURN





-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN





 





# all other non-local packets are dropped





-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny





-A ufw-not-local -j DROP





 





# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above





# is uncommented)





-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT





 





# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above





# is uncommented)





-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT





 





# don't delete the 'COMMIT' line or these rules won't be processed





COMMIT





 





 





*nat





:PREROUTING - [0:0]





:POSTROUTING - [0:0]





-A PREROUTING  -p tcp --dport 8080 -j DNAT --to-destination 192.168.44.101:80





-A PREROUTING  -p tcp --dport 6692 -j DNAT --to-destination 192.168.44.101:6692





-A POSTROUTING -p tcp -d 192.168.44.101 --dport 80 -j SNAT --to-source 192.168.44.100





-A POSTROUTING -p tcp -d 192.168.44.101 --dport 6692 -j SNAT --to-source 192.168.44.100





COMMIT

参考：配置iptables、ufw端口转发_maxuearn的博客-CSDN博客_ufw端口转发

29094 人正在系统学习中