經驗分享:Linux 雙網卡SNAT和DNAT映射本地端口出外網

A 機器

網卡1  公網IP
網卡2  內網　

B 機器
網卡1 內網 

若是想把公網端口P1 映射爲內網B機器端口P2

iptables -t nat -A PREROUTING -d [A公網地址] -p tcp -m tcp --dport [公網端口] -j DNAT --to-destination [B內網IP]:[B內網端口]
iptables -t nat -A POSTROUTING -d [B內網IP] -p tcp -m tcp --dport [B內網端口] -j SNAT --to-source [A內網地址]
iptables -A FORWARD -o [A內網網卡] -d [B內網IP] -p tcp --dport [B內網端口] -j ACCEPT
iptables -A FORWARD -i [A內網網卡] -s [B內網IP] -p tcp –sport [B內網端口] -j ACCEPT

 

 

*nat
:PREROUTING ACCEPT [16232:957099]
:INPUT ACCEPT [16232:957099]
:OUTPUT ACCEPT [33:2307]
:POSTROUTING ACCEPT [33:2307]
-A PREROUTING -d 172.168.6.195/32 -p tcp -m tcp --dport 10000 -j DNAT --to-destination 172.168.6.202:5222
-A POSTROUTING -d 172.168.6.202/32 -p tcp -m tcp --dport 5222 -j SNAT --to-source 172.168.6.195
COMMIT
# Completed on Thu Jun 2 10:17:46 2016
# Generated by iptables-save v1.4.12 on Thu Jun 2 10:17:46 2016
*filter
:INPUT ACCEPT [1048988:102011563]
:FORWARD ACCEPT [7312:1019956]
:OUTPUT ACCEPT [744535:106322618]
-A FORWARD -d 172.168.6.202/32 -p tcp -m tcp --dport 5222 -j ACCEPT
COMMIT