优秀的编程知识分享平台

网站首页 > 技术文章 正文

SNAT/DNAT实现外网访问内网

nanyue 2025-05-11 17:28:31 技术文章 3 ℃

一、环境信息

SNAT：内部地址要访问公网上的服务时（如web访问），内部地址会主动发起连接，由路由器或者防火墙上的网关对内部地址做个地址转换，将内部地址的私有IP转换为公网的公有IP，网关的这个地址转换称为SNAT，主要用于内部共享IP访问外部。

DNAT：当内部需要提供对外服务时（如对外发布web网站），外部地址发起主动连接，由路由器或者防火墙上的网关接收这个连接，然后将连接转换到内部，此过程是由带有公网IP的网关替代内部服务来接收外部的连接，然后在内部做地址转换，此转换称为DNAT，主要用于内部服务对外发布。

在配置防火墙或者路由acl策略时要注意这两个NAT一定不能混淆。

SNAT ens33:10.68.100.180 ens36:192.168.11.180

web服务器 　 192.168.11.181

客户端 10.68.100.183 　

二、配置

Node1: SNAT网关服务器配置

Ens33:

[root@node1 ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens33

TYPE="Ethernet"

PROXY_METHOD="none"

BROWSER_ONLY="no"

BOOTPROTO="none"

DEFROUTE="yes"

IPV4_FAILURE_FATAL="no"

IPV6INIT="yes"

IPV6_AUTOCONF="yes"

IPV6_DEFROUTE="yes"

IPV6_FAILURE_FATAL="no"

IPV6_ADDR_GEN_MODE="stable-privacy"

NAME="ens33"

UUID="3ef9c82a-a30e-4499-b55f-8cf29f7f0ac8"

DEVICE="ens33"

ONBOOT="yes"

IPADDR="10.68.100.180"

PREFIX="24"

#GATEWAY="10.68.100.2"

#DNS1="114.114.114.114"

IPV6_PRIVACY="no"

Ens36:

[root@node1 ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens36

TYPE="Ethernet"

PROXY_METHOD="none"

BROWSER_ONLY="no"

BOOTPROTO="none"

DEFROUTE="yes"

IPV4_FAILURE_FATAL="no"

IPV6INIT="yes"

IPV6_AUTOCONF="yes"

IPV6_DEFROUTE="yes"

IPV6_FAILURE_FATAL="no"

IPV6_ADDR_GEN_MODE="stable-privacy"

NAME="ens36"

DEVICE="ens36"

ONBOOT="yes"

IPADDR="192.168.11.180"

PREFIX="24"

[root@node1 ~]# vi /etc/sysctl.conf

# sysctl settings are defined through files in

# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.

#

# Vendors settings live in /usr/lib/sysctl.d/.

# To override a whole file, create a new file with the same in

# /etc/sysctl.d/ and put new settings there. To override

# only specific settings, add a file with a lexically later

# name in /etc/sysctl.d/ and put new settings there.

#

# For more information, see sysctl.conf(5) and sysctl.d(5).

net.ipv4.ip_forward=1

[root@node1 ~]# vi /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

# enforcing - SELinux security policy is enforced.

# permissive - SELinux prints warnings instead of enforcing.

# disabled - No SELinux policy is loaded.

SELINUX=disabled

# SELINUXTYPE= can take one of three values:

# targeted - Targeted processes are protected,

# minimum - Modification of targeted policy. Only selected processes are protected.

# mls - Multi Level Security protection.

SELINUXTYPE=targeted

Systemctl stop firewalld

Systemctl disable firewalld

yum install iptables iptables-services -y

systemctl start iptables.service

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT #修改默认规则为允许

iptables -F && iptables -t nat -F #清除所有规则

service iptables save #保存规则

iptables -t nat -nL 查看nat中规则清除成功

Node2:

Ens36:

[root@node2 ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens36

TYPE="Ethernet"

PROXY_METHOD="none"

BROWSER_ONLY="no"

BOOTPROTO="none"

DEFROUTE="yes"

IPV4_FAILURE_FATAL="no"

IPV6INIT="yes"

IPV6_AUTOCONF="yes"

IPV6_DEFROUTE="yes"

IPV6_FAILURE_FATAL="no"

IPV6_ADDR_GEN_MODE="stable-privacy"

NAME="ens36"

DEVICE="ens36"

ONBOOT="yes"

IPADDR="192.168.11.181"

PREFIX="24"

GATEWAY=192.168.11.180

Systemctl stop firewalld

Systemctl disable firewalld

Node3:

Ens33:

[root@node3 ~]# more /etc/sysconfig/network-scripts/ifcfg-ens33

TYPE="Ethernet"

PROXY_METHOD="none"

BROWSER_ONLY="no"

BOOTPROTO="none"

DEFROUTE="yes"

IPV4_FAILURE_FATAL="no"

IPV6INIT="yes"

IPV6_AUTOCONF="yes"

IPV6_DEFROUTE="yes"

IPV6_FAILURE_FATAL="no"

IPV6_ADDR_GEN_MODE="stable-privacy"

NAME="ens33"

UUID="5d003e36-324a-403e-b8a1-6f969a7003d2"

DEVICE="ens33"

ONBOOT="yes"

IPADDR="10.68.100.183"

PREFIX="24"

GATEWAY="10.68.100.180"

IPV6_PRIVACY="no"

Systemctl stop firewalld

Systemctl disable firewalld

三、执行SNAT和DNAT命令

SNAT:

iptables -t nat -A POSTROUTING -s 10.68.100.0/24 -o ens36 -j SNAT --to 192.168.11.180

DNAT:

iptables -t nat -A PREROUTING -i ens33 -d 10.68.100.180 -p tcp --dport 80 -j DNAT --to 192.168.11.181

四、验证

Node3:

[root@node3 ~]# curl http://10.68.100.180

<!DOCTYPE html>

<html>

<head>

<title>Welcome to nginx!</title>

<style>

html { color-scheme: light dark; }

body { width: 35em; margin: 0 auto;

font-family: Tahoma, Verdana, Arial, sans-serif; }

</style>

</head>

<body>

<h1>Welcome to 181 nginx!</h1>

<p>If you see this page, the nginx web server is successfully installed and

working. Further configuration is required.</p>

<p>For online documentation and support please refer to

<a href="http://nginx.org/">nginx.org</a>.<br/>

Commercial support is available at

<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>

</body>

</html>

Node2:

[root@node2 ~]# tail -f /var/log/nginx/access.log

192.168.11.180 - - [25/Mar/2024:17:12:02 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

10.68.100.183 - - [25/Mar/2024:17:38:59 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

192.168.11.180 - - [26/Mar/2024:10:25:22 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

10.68.100.183 - - [26/Mar/2024:10:25:33 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

10.68.100.183 - - [26/Mar/2024:10:30:41 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

192.168.11.180 - - [26/Mar/2024:10:31:45 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

192.168.11.180 - - [26/Mar/2024:10:41:27 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

192.168.11.180 - - [26/Mar/2024:10:53:50 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

192.168.11.180 - - [26/Mar/2024:10:54:21 +0800] "GET / HTTP/1.1" 200 619 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" "-"

192.168.11.180 - - [26/Mar/2024:10:54:21 +0800] "GET /favicon.ico HTTP/1.1" 404 555 "http://10.68.100.180/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" "-"

192.168.11.180 - - [26/Mar/2024:11:27:48 +0800] "GET / HTTP/1.1" 200 619 "-" "curl/7.29.0" "-"

以上内容在虚拟机实现，如有疑问，欢迎留下宝贵的意见。

Tags：

猜你喜欢

最近发表
标签列表