\documentclass[letterpaper,english]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{Linux 2.4 NAT HOWTO}
\author{×÷Õß£ºRusty Russell, mailing list {\ttfamily netfilter@lists.samba.org}\\ 
ÒëÕß£ºÍøÖÐÈË {\ttfamily netmanforever@yahoo.com}}
\date{v1.0.1 Mon May  1 18:38:22 CST 2000}
\abstract{±¾ÎÄ¼þÃèÊöÈçºÎÓÃ 2.4 Linux ºËÐÄÈ¥×ö masquerading¡¢transparent proxying¡¢port forwarding¡¢ºÍÆäËüÀàÐÍµÄ Network Address Translations ¡£}


\begin{document}
\maketitle
\tableofcontents

\section{Introduction\label{intro}}

Ç×°®µÄ¶ÁÕß£¬»¶Ó­Äú£¡



Äú½«ÒªÌ½Ë÷µÄÊÇÒýÈËÈëÊ¤(ÓÐÊ±Âù¿Ö²À)µÄ NAT(Network Address Translation) ÊÀ½ç£¬Í¬Ê±£¬ÄúÉõÖÁ¿ÉÒÔ°ÑÕâ·Ý HOWTO µ±³É Linux 2.4 ºËÐÄ¼°ÒÔáá°æ±¾µÄ¾«È·Ö¸ÄÏÄØ¡£



ÔÚ Linux 2.4 ÀïÃæ£¬ÓÐÒ»¸ö½Ð `netfilter' µÄ¶«¶«£¬ËüÊÇ×¨ÃÅËºÁÑ (mangling* )·â°üµÄ¡£ÔÚËüÔÙÉÏÒ»¸ö²ã¼¶£¬¾ÍÊÇÌá¹© NAT ¹¦ÄÜµÄÁË£¬ÔòÊÇÍêÈ«ÓÉÒÔÍùµÄºËÐÄÊµ×÷¶ø³ÉµÄ¡£



(ÒëÕß×¢£ººÜÆæ¹Ö£¬Ô­×÷ÕßÓÃ mangle ÕâÒ»´Ê£¬ËÆºõÔÚ¹ýÍùµÄÖÐÎÄÎÄ¼þÖÐ¶¼Ã»Åöµ½¹ý£¬²é¹ýºÃ¶à×Öµä¶¼²»ÖªµÀÔõ÷á·­ÒëºÃ¡£ÕâÀïÔÝÊ±ÃãÇ¿ÓÃ¡®ËºÁÑ¡¯Õâ¸ö´Ê´úÌæ£¬²»¹ýááÃæÎÒ¾Í²»³¢ÊÔ·­ÒëÕâ´ÊÁË£¬ÈÃ¶ÁÕß×Ô¼ºÈ¥Àí½â°É¡£)




\section{¹Ù·½µÄÍøÕ¾ºÍÍ¨ÐÅÂÛÌ³ºÎ´¦ÃÙ£¿}

Ä¿Ç°ÓÐÈý¸ö¹Ù·½ÍøÕ¾¿É¹©ä¯ÀÀ£º
\begin{itemize}
\item ¸ÐÐ» \nameurl{http://netfilter.filewatcher.org}{Filewatcher (http://netfilter.filewatcher.org)}.
\item ¸ÐÐ» \nameurl{http://www.samba.org/netfilter}{The Samba Team and SGI (http://www.samba.org/netfilter)}.
\item ¸ÐÐ» \nameurl{http://netfilter.kernelnotes.org}{Jim Pick (http://netfilter.kernelnotes.org)}.
\end{itemize}




¶ø¹Ù·½µÄ netfilter ÓÊ¼þÂÛÌ³£¬Ôò¿ÉÒÔµ½ÕâÀï¿´£º
\nameurl{http://lists.samba.org}{Samba's Listserver (http://lists.samba.org)}.




\subsection{ºÎÎª Network Address Translation?}

Ò»°ãÀ´Ëµ£¬ÔÚÍøÂ·ÉÏ·â°ü´ÓÆäÀ´Ô´(±È·½Äú¼ÒÖÐµÄµçÄÔ)³öÈ¥£¬È»ááµ½´ïÄ¿µÄµØ(±È·½www.kernelnotes.org)£¬»á¾­¹ýÐíÐí¶à¶à¸ö²»Í¬µÄÁ¬½Ó(links)£º¾ÍÎÒËùÔÚµÄ°ÄÖÞÀ´Ëµ¾Í´óÔ¼ÓÐ 19 ¸öÖ®¶à¡£Ã»ÓÐÈÎºÎÒ»¸öÁ¬½Ó»áÕæµÄÈ¥¸ü¸ÄÄúµÄ·â°ü£ºËûÃÇ½ö½öÊÇ½«Ö®´«ËÍ³öÈ¥¶øÒÑ¡£



¼ÙÈçÆäÖÐÒ»¸öÁ¬½Ó»á×ö NAT µÄ»°£¬È»ááËüÃÇ¾Í»á¸ü¸ÄÄÇÐ©¾­Ëü¶ø¹ýµÄ·â°üÖ®À´Ô´»òÄ¿µÄµØµØÖ·¡£³ÏÈçÄúÄÜÏëÏñµÃµ½µÄ£¬Õâ²¢·ÇÏµÍ³±»Éè¼Æ³ÉÕâÑùµÄ£¬¶øÊÇ NAT Ëù×öµÄÊÖ½Å¶øÒÑ¡£Í¨³£Òª×ö NAT µÄÁ¬Ïß»á¼Ç×¡ËüÈçºÎ mangled ·â°üµÄ£¬È»ááµ±»ØÓ¦·â°ü´ÓÁíÒ»·½Ïò¹ýÀ´µÄÊ±ºò£¬È»áá¾Í·´¹ýÀ´ mangling ÄÇ¸ö»ØÓ¦·â°ü£¬ËùÒÔËùÓÐ¶«Î÷¶¼¹¤×÷ÆðÀ´ÁË¡£




\subsection{ÎªÊ²÷áÎÒÒª×ö NAT ÄØ£¿}

ÔÚÍêÃÀµÄÊÀ½çÀï£¬ÄúÎÞÐèÕâÑù×öÀ²¡£ÔÚÄ¿Ç°À´Ëµ£¬»¹ÊÇÓÐÆäÀíÓÉµÄ£º

\begin{description}
\item[ÓÃ modem ²¦½ÓÉÏÍø] \mbox{}

´ó¶àÊýµÄ ISP ÔÚÄúÁ¬ÉÏÈ¥µÄÊ±ºòÖ»»á¸øÄúÒ»¸öµ¥Ò» IP µØÖ·¡£ÄúÏ²»¶µÄ»°£¬ÒÔÈÎºÎÀ´Ô´µØÖ·°Ñ·â°üËÍ³öÈ¥¶¼ÐÐ£¬µ«Ö»ÓÐ»ØÓ¦µ½Õâ¸öÀ´Ô´µØÖ·µÄ·â°ü²Å¿ÉÒÔ»Øµ½ÄúÄÇÀï¡£Èç¹ûÄúÏëÓÃ¶àÌ¨²»Í¬Ö÷»ú(ÀýÈç¼ÒÖÐÍøÂ·)Í¸¹ý¸ÃÁ¬½ÓÉÏ internet µÄ»°£¬ÄÇÄú¾ÍÒª NAT ÁË¡£



ÕâÒ²¾ÍÊÇ½ñÌì NAT ×î³£ÓÃÖ®´¦£¬¶øÔÚ Linux ÊÀ½ç×îÎªÈËÖªµÄ¾ÍÊÇËùÎ½µÄ `masquerading(·â°üÎ±×°Êõ)' ÁË¡£ÎÒ³ÆÖ®Îª SNAT£¬ÒòÎªÄú¸Ä±äÁËµÚÒ»¸ö·â°üµÄ {\bfseries source(À´Ô´)} µØÖ·µÄÔµ¹Ê¡£



\item[¶àÖØËÅ·þÆ÷] \mbox{}

ÓÐÊ±ºò£¬Äú»áÏëÈ¥¸Ä±äÄÇÐ©½øÈëÄúÍøÂ·µÄ·â°üÖ®Â·Ïò¡£Õâ×î³£ÊÇÒòÎª(ÈçÉÏÊö)ÄúÖ»ÓÐÒ»¸ö IP µØÖ·£¬µ«ÄúÈ´ÏëÈÃ±ðÈËÄÜ¹»Á¬½Óµ½ `ÕæÊµ' IP µØÖ·ááÃæµÄÖ÷»úÈ¥¡£Èç¹ûÄúÖØÐ´ÕâÐ©ÄÚËÍ·â°üµÄÄ¿µÄµØÖ·£¬ÕâÑùÄú¾Í¿ÉÒÔ¹ÜÀíËüÃÇÁË¡£



Ò»¸ö³£¼ûµÄ±ä¶¯ÊÇ¸ºÔØ·Öµ£(load-sharing)£¬Ò²¾ÍÊÇÔÚÒ»×é»úÆ÷ÉÏÃæÎª·â°ü×öÓ³¶Ô(mapping)µÄ¶¯×÷¡£ÕâÀàÐÍµÄ NAT £¬ÔÚÒÔÇ°µÄµÄ Linux °æ±¾ÖÐÒ²¾Í±»³ÆÎª port-forwarding ¡£



\item[Í¸Ã÷´úÀí(Transparent Proxying)] \mbox{}

ÓÐÊ±ºò£¬Äú»òÐíÏëÒªÃ¿Ò»¸ö¾­¹ýÄúµÄ Linux Ö÷»úµÄ·â°üËÍÖÁÖ÷»ú±¾ÉíµÄÒ»¸ö³ÌÊ½È¥¡£Õâ¾ÍÐèÒª½øÐÐÍ¸Ã÷´úÀíµÄ¶¯×÷ÁË£ºÒ»¸ö´úÀí¾ÍÊÇÒ»¸öÎ»ì¶ÄúµÄÍøÂ·ºÍÍâ²¿ÍøÂ·µÄ³ÌÊ½£¬Îª±Ë´ËË«·½¸ºÆð¹µÍ¨µÄÈÎÎñ¡£¶øËùÎ½µÄÍ¸Ã÷£¬ÔòÊÇÒòÎªÄúµÄÍøÂ·ÉõÖÁÎÞÐëÖªµÀÔÚºÍÒ»¸ö´úÀí¶Ô½²£¬µ±È»ÁË£¬³ý·Ç´úÀí²»ÔÙ¹¤×÷ÁË°É¡£



Squid ¿ÉÒÔÅäÖÃ³ÉÕâÑùµÄ¹¤×÷·½Ê½£¬Õâ¾ÍÊÇÔÚ¹ýÍùµÄ Linux °æ±¾ÖÐËùÎ½µÄÖØµ¼Ïò(redirection)¡¢»òÍ¸Ã÷´úÀíÁË¡£

\end{description}





\section{Á½ÖÖÀàÐÍµÄ NAT}

ÎÒ½« NAT ·ÖÎªÁ½ÖÖ²»Í¬µÄÀàÐÍ£º {\bfseries Source NAT} (SNAT) Óë {\bfseries Destination NAT} (DNAT)



Source NAT ¾ÍÊÇÄú½«¸Ä±äµÚÒ»¸ö·â°üµÄÀ´Ô´µØÖ·£ºÀýÈç£¬ÄúÎª´«ÈëµÄÁ¬Ïß×ö caching µÄ¶¯×÷¡£Source NAT ÓÀÔ¶»áÔÚ·â°ü´«³öÍøÏßÖ®Ç°¾Í×öºÃ post-routing µÄ¶¯×÷¡£·â°üÎ±×°(Masquerading)¾ÍÊÇÒ»¸ö SNAT ÌØÀý¡£



Destination NAT ¾ÍÊÇÄú½«¸Ä±äµÚÒ»¸ö·â°üµÄÄ¿µÄµØµØÖ·£ºÀýÈçÄúÒªÎª´«³öµÄÁ¬Ïß×ö caching µÄ¶¯×÷¡£Destination NAT ÓÀÔ¶»áÔÚ·â°ü´ÓÍøÏß½øÈëÖ®áá¾ÍÂíÉÏ×öºÃ pre-routing µÄ¶¯×÷¡£Port forwarding¡¢¸ºÔØ·Öµ£¡¢ÒÔ¼°Í¸Ã÷´úÀí£¬¶¼Êôì¶ DNAT¡£




\section{´Ó 2.0 µ½ 2.2 ºËÐÄµÄ¿ìËÙ×ª±ä}

·Ç³£±§Ç¸£¬¼ÙÈçÄúÈÔÈ»Ã¦ì¶´Ó 2.0(ipfwadm) µ½ 2.2(ipchains) µÄ×ªÐÍµÄ»°¡£²»¹ý£¬ÕâÒ²ÊÇ¸öÏ²ÓÇ²Î°ëµÄÏûÏ¢À²¡£



Ê×ÏÈ£¬Äú¿ÉÒÔÇáÒ×µÄÒ»ÈçÍùÎôµØÊ¹ÓÃ ipchains ºÍ ipfwadm¡£ÒªÕâÑù×öµÄ»°£¬ÄúÐèÒª½«×îÐÂµÄ netfilter Ì×¼þÖÐµÄ  `ipchains.o' »ò `ipfwadm.o' ºËÐÄÄ£×éÔØÈë¡£ËüÃÇÊÇÏà»¥ÅÅ³âµÄ(ÄúÓ¦ÒÑ»ñ¾¯¸æÁË)£¬Í¬Ê±Ò²²»ÄÜºÍÆäËü netfilter Ä£×éÍ¬Ê±ÕûºÏÔÚÒ»Æð¡£



Ò»µ©ÆäÖÐÒ»¸öÄ£×é±»ÔØÈë£¬Äú¾Í¿ÉÒÔÈç³£Ê¹ÓÃ ipchains ºÍ ipfwadm ÁË£¬µ«Ò²ÓÐÈçÏÂÒ»Ð©±ä»¯À²£º

\begin{itemize}
\item  ÓÃ ipchains -M -S£¬»òÊÇ ipfwadm -M -s ×÷Î±×°ÓâÊ±½«²»ÔÙÓÐÐ§¡£ÒòÎªÓâÊ±Éè¶¨ÒÑ¾­ÒÆÖÁÐÂµÄ NAT ¼Ü¹¹ÖÐ£¬ËùÒÔÕâÀïÒ²¾ÍÃ»Ê²÷áËùÎ½ÁË¡£
\item  ÔÚÎ±×°ÁÐ±íÖÐÏÔÊ¾µÄ ini\_seq¡¢delte¡¢ºÍ previous\_delta À¸Î»£¬½«ÓÀÔ¶ÎªÁã¡£
\item  Í¬Ê±¹éÁã(zeroing)ºÍÁÐÊ¾¼ÇÊýÆ÷(counter)µÄ `-Z -L' ÒÑÎÞ×÷ÓÃ£º¼ÇÊýÆ÷½«²»ÄÜÔÙ¹éÁãÁË¡£
\end{itemize}


Hacker ÃÇÈÔÒªÁôÒâÖ®´¦£º

\begin{itemize}
\item  ÄúÏÖÔÚ¿ÉÒÔÀ¦°ó 61000-65095 Ö®¼äµÄ²º¿Ú£¬¶øÎÞÐèÀí»áÄúÊÇ·ñÊ¹ÓÃ·â°üÎ±×°¼¼Êõ¡£ÔÚ¹ýÈ¥£¬·â°üÎ±×°³ÌÊ½»á°Ñ´ËÖµÓòÄÚµÄËùÓÐ¶«Î÷²¶»ñ½øÀ´£¬ËùÒÔÆäËü³ÌÊ½¾Í²»¿ÉÓÃÖ®ÁË¡£
\item  ÖÁì¶(ÉÐÎ´³ÉÎÄÖ®) getsockname ÆÆ½â£¬ÔÚ¹ýÈ¥£¬Í¸Ã÷´úÀí³ÌÊ½¿ÉÒÔÕÒ³öÄÇÐ©²»ÔÙÓÐÐ§Á¬ÏßÖ®ÕæÕýÄ¿µÄµØ¡£
\item  ÖÁì¶(ÉÐÎ´³ÉÎÄÖ®) bind-to-foreign-address ÆÆ½â£¬Í¬ÑùÉÐÎ´Êµ×÷£»ÕâÔÚ¹ýÈ¥ÓÃÒÔÍêÉÆÍ¸Ã÷´úÀíµÄ¹¹Ïë¡£
\end{itemize}





\subsection{¾ÈÃü°¡£¡ÎÒÖ»ÏëÒª·â°üÎ±×°¶øÒÑ£¡}

Ã»´í£¬ÕâÒ²ÊÇ´ó¶àÊýÅóÓÑÖ®Ðè¡£Èç¹ûÄúÓÃ PPP ²¦½Ó»ñµÃµÄ¶¯Ì¬ IP (Èç¹ûÄú²»ÁË½âµÄ»°£¬ÄÇÄúÓ¦¸ÃÊÇÁË)£¬Äú»òÐíÖ»Ïëµ¥´¿¸æËßÄúµÄÖ÷»úÈÃËùÓÐÀ´×ÔÄúÄÚ²¿ÍøÂ·µÄ·â°ü£¬¿´ÆðÀ´ÈçÀ´×Ô¸Ã PPP ²¦½ÓÖ÷»úÒ»Ñù¡£

\begin{tscreen}
\begin{verbatim}
# Load the NAT module (this pulls in all the others).
modprobe iptable_nat

# In the NAT table (-t nat), Append a rule (-A) after routing
# (POSTROUTING) for all packets going out ppp0 (-o ppp0) which says to
# MASQUERADE the connection (-j MASQUERADE).
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
\end{verbatim}
\end{tscreen}


×¢£ºÄúÕâÀï²¢Ã»×öÈÎºÎ·â°ü¹ýÂË£ºÈçÒªµÄ»°£¬Çë²Î¿¼ Packet Filtering HOWTO£º½« NAT ºÍ·â°ü¹ýÂËºÏ²¢ÆðÀ´¾ÍÊÇÁË¡£




\subsection{ÄÇ ipmasqadm Ôõ÷áÁË£¿}

Õâ¸öÆäÊµÈ¡¾öì¶Ê¹ÓÃÕß¶øÒÑ£¬ËùÒÔÎÒ²¢²»ÊÇºÜÎªÏòáá¼æÈÝÎÊÌâ¶øµ£ÐÄ¡£Äú¿ÉÒÔµ¥´¿Ê¹ÓÃ iptables -t nat ×ö port forwarding µÄ¶¯×÷¡£ÀýÈç£¬ÔÚ Linux 2.2 Äú»òÐíÒÑ¾­ÕâÑù×öÁË£º

\begin{tscreen}
\begin{verbatim}
# Linux 2.2
# Forward TCP packets going to port 8080 on 1.2.3.4 to 192.168.1.1's port 80
ipmasqadm portfw -a -P tcp -L 1.2.3.4 8080 -R 192.168.1.1 80
\end{verbatim}
\end{tscreen}


¶øÏÖÔÚ£¬Èç´ËÔò¿É£º

\begin{tscreen}
\begin{verbatim}
# Linux 2.4
# Append a rule pre-routing (-A PREROUTING) to the NAT table (-t nat) that
# TCP packets (-p tcp) going to 1.2.3.4 (-d 1.2.3.4) port 8080 (--dport 8080)
# have their destination mapped (-j DNAT) to 192.168.1.1, port 80
# (--to 192.168.1.1:80).
iptables -A PREROUTING -t nat -p tcp -d 1.2.3.4 --dport 8080 \
        -j DNAT --to 192.168.1.1:80
\end{verbatim}
\end{tscreen}


¼ÙÈçÄúÏëÈÃÕâÌõ¹æÔòÍ¬Ê±ÐÞ¸Ä±¾»úÁ¬ÏßµÄ»°(Èç£¬¼´Ê¹ÔÚ NAT Ö÷»ú±¾Éí£¬ÒªÁ¬½Ó 1.2.3.4 µÄ 8080 ²º¿ÚÖ® telnet Á¬Ïß£¬»á°ïÄúÁ¬½ÓÖÁ 192.168.1.1 µÄ 80 ²º¿Ú)£¬Äú¾Í¿ÉÒÔ²åÈëÏàÍ¬µÄ¹æÔòÖÁ OUTPUT Á´ÖÐ(ËüÖ»ÊÊÓÃì¶±¾»ú´«³öµÄ·â°ü)£º

\begin{tscreen}
\begin{verbatim}
# Linux 2.4
iptables -A OUTPUT -t nat -p tcp -d 1.2.3.4 --dport 8080 \
        -j DNAT --to 192.168.1.1:80
\end{verbatim}
\end{tscreen}





\section{¿ØÖÆÄÄÐ©Òª NAT}

ÄúÐèÒª½¨Á¢Ò»Ð© NAT ¹æÔò£¬À´¸æËßºËÐÄÄÄÐ©Á¬ÏßÒª¸Ä±ä£¬Í¬Ê±ÈçºÎÈ¥¸Ä±äËüÃÇ¡£Òª×öµ½Õâµã£¬ÎÒÃÇÐèÒªÒ»¸ö·Ç³£¶àÓÃÍ¾µÄ {\ttfamily iptables} ¹¤¾ß£¬Í¬Ê±Ö¸¶¨ `-t nat' Ñ¡Ïî¸æËßËüÈ¥ÐÞ¸Ä NAT ±í¸ñ¡£



NAT ¹æÔòµÄ±í¸ñº¬ÓÐÈý¸öÁÐ±í½Ð×ö`chains' £ºÃ¿Ò»Ìõ¹æÔò¶¼°´Ë³Ðò¼ì²é£¬Ö±µ½ÕÒµ½Ò»¸öÏà·ûµÄ±È¶Ô¡£¸ÃÈý¸öÁ´¾Í½Ð×ö PREROUTING (¶Ô Destination NAT À´Ëµ£¬ÒòÎª·â°üÊ×ÏÈÊÇ´«ÈëµÄ)¡¢POSTROUTING (¶Ô Source NAT À´Ëµ£¬ÒòÎª·â°üÊÇÀë¿ªµÄ)¡¢ÒÔ¼° OUTPUT (¶Ô Destination NAT À´Ëµ£¬ÊÇÖ¸ÄÇÐ©ÓÉ±¾»ú²úÉúµÄ·â°ü)¡£



 ¼ÙÈçÎÒ¹»ÒÕÊõÌì·ÝµÄ»°£¬ÏÂÃæµÄÍ¼Ê¾½«×¼È·Ä£Äâ³öÉÏÃæËùËµµÄ¸ÅÄî¡£

\begin{tscreen}
\begin{verbatim}
      _____                                     _____
     /     \                                   /     \
   PREROUTING -->[Routing ]----------------->POSTROUTING----->
     \D-NAT/     [Decision]                    \S-NAT/
                     |                            ^
                     |                          __|__
                     |                         /     \
                     |                        | OUTPUT|
                     |                         \D-NAT/
                     |                            ^
                     |                            |
                     --------> Local Process ------
\end{verbatim}
\end{tscreen}


ì¶Ç°ÊöµÄÃ¿Ò»µã£¬µ±Ò»¸ö·â°üÍ¨¹ýÎÒÃÇÒª²é¿´µÄÏà¹ØÁ¬ÏßÖ®Ê±£¬Èç¹ûËüÊÇÒ»¸öÐÂ½¨Á¬Ïß£¬ÎÒÃÇ²é¿´ËüÔÚ NAT ±í¸ñÀï¶ÔÓ¦µÄÁ´£¬¿´¿´ÄÜ¶ÔÖ®×öÐ©Ê²÷á¶¯×÷¡£¶øÓÉ´Ë»ñµÃµÄ´ð°¸¾ÍÓ¦ÓÃì¶¸ÃÁ¬Ïß½«À´µÄËùÓÐ·â°ü¡£




\subsection{ÓÃ iptables ×ö¼òµ¥µÄÑ¡Ôñ}

{\ttfamily iptables} ¾ßÓÐÈçááËùÁÐµÄÐí¶à±ê×¼Ñ¡Ïî¡£ËùÓÐÄÇÐ©´øË«¼õºÅµÄÑ¡Ïî¶¼ÊÇ¿ÉÒÔËõÐ´µÄ£¬Ö»Òª {\ttfamily iptables} ÈÔ¿É½«Ö®ÓëÆäËü¿ÉÄÜµÄÑ¡ÏîÇø·Ö¿ªÀ´¾ÍÐÐ¡£Èç¹ûÄúµÄºËÐÄÒÔÄ£×éÐÎÊ½À´Ö§Ô® iptables £¬Äú¾ÍÐèÒªÊ×ÏÈÔØÈë ip\_tables.o £º `insmod ip\_tables'¡£



ÕâÀï£¬×îÖØÒªµÄÒ»¸öÑ¡ÏîÊÇ±í¸ñÑ¡ÔñÑ¡Ïî£º `-t' ¡£¶Ôì¶ËùÓÐµÄ NAT ²Ù×÷£¬Äú»áÏëÓÃ `-t nat' À´±íÊ¾ NAT ±í¸ñ¡£µÚ¶þ¸öÖØÒªµÄÑ¡ÏîÊÇÒÔ `-A' Ôö¼ÓÒ»ÌõÐÂ¹æÔòÖÁÁ´µÄÄ©¶Ë (Èç£º`-A POSTROUTING')£¬»òÒÔ  `-I' ²åÈëÖÁÇ°¶Ë(Èç£º`-I PREROUTING')¡£



Äú¿ÉÒÔÖ¸¶¨ÄúÒª×ö NAT µÄ·â°üÀ´Ô´µØÖ· (`-s' »ò `--source') ÓëÄ¿µÄµØ (`-d' or `--destination')¡£ÕâÁ½¸öÑ¡ÏîááÃæ¿ÉÒÔáá½ÓÒ»¸öµ¥Ò»µÄ IP µØÖ· (Èç£º192.168.1.1)£¬»òÒ»¸öÃû³Æ (Èç£º www.kernelnotes.org)£¬»òÒ»¸öÍøÂ·µØÖ· (Èç£º192.168.1.0/24 »ò 192.168.1.0/255.255.255.0)¡£



ÄúÒ²¿ÉÒÔÖ¸¶¨Òª±È¶ÔµÄ´«Èë (`-i' »ò `--in-interface') ºÍ´«³ö (`-o' or `--out-interface') ½çÃæ£¬µ«ÄÄÒ»¸ö½çÃæ¿ÉÒÔÖ¸¶¨ÔòÈ¡¾öì¶ÄúÒª½«¹æÔòÐ´ÈëÄÄÒ»¸öÁ´È¥£º¶Ôì¶ PREROUTING £¬Äú¿ÉÒÔÑ¡Ôñ´«Èë½çÃæ£¬µ«¶Ôì¶ POSTROUTING (ÒÔ¼° OUTPUT)£¬Äú¿ÉÒÔÑ¡Ôñ´«³ö½çÃæ¡£Èç¹ûÄú²»Ð¡ÐÄÓÃ´íÁË£¬ {\ttfamily iptables} ¾Í»á¸øÄúÒ»¸ö´íÎó¡£




\subsection{¹Øì¶ÌôÑ¡ÄÄÐ©·â°üÀ´ mangle µÄÏ¸½Ú}

ÎÒÇ°ÃæÒÑ¾­Ëµ¹ý£¬Äú¿ÉÒÔÖ¸¶¨À´Ô´ºÍÄ¿µÄµØµØÖ·¡£Èç¹ûÄúÊ¡ÂÔÀ´Ô´µØÖ·µÄÑ¡Ïî£¬ÄÇ÷á¾Í·ºÖ¸ÈÎºÎÀ´Ô´¡£Èç¹ûÄúÊ¡ÂÔÄ¿µÄµØµØÖ·£¬Ôò·ºÖ¸ËùÓÐÄ¿µÄµØµØÖ·¡£



Äú»¹¿ÉÒÔÖ¸¶¨Ò»¸öÌØ¶¨Ð­¶¨ (`-p' or `--protocol')ÄØ£¬ÀýÈç TCP »ò UDP£ºÖ»ÓÐÕâÐ©Ð­¶¨µÄ·â°ü²Å·ûºÏ¸Ã¹æÔò¡£ÆäÖ÷ÒªÔ­ÒòÊÇ£¬Ö¸¶¨ tcp »ò udp Ð­¶¨¿ÉÒÔÔÊÐí¸ü¶àÑ¡Ïî£ºÓÈÆäÊÇ  `--source-port' Óë `--destination-port' Ñ¡Ïî (ËõÐ´Îª `--sport' Óë `--dport' )¡£



ÕâÐ©Ñ¡Ïî¿ÉÒÔÈÃÄúÖ¸¶¨Ö»ÓÐÄÄÐ©ÌØ¶¨À´Ô´ºÍÄ¿µÄµØ²º¿ÚµÄ·â°ü²Å·ûºÏ¸Ã¹æÔò¡£ÕâÔÚÄúÒªÖØµ¼ web ÇëÇó  (TCP port 80 »ò 8080) µ«ÓÖÅÂÓ°ÏìÆäËü·â°üµÄÊ±ºò£¬¾ÍºÜºÃÓÃÁË¡£



ÕâÐ©Ñ¡Ïî±ØÐë½ÓÔÚ  `-p' Ñ¡ÏîµÄááÃæ(Õâ»áÔÚÎª¸ÃÐ­¶¨ÔØÈë¹²Ïíº¯Ê½¿âÊ±ÓÐ¸±×÷ÓÃ)¡£Äú¿ÉÒÔÊ¹ÓÃ²º¿ÚºÅÂë£¬»òÕßÊÇÔÚ /etc/services µµÖÐµÄÃû³Æ¡£



ËùÓÐÕâÐ©ÄúÄÜÑ¡ÔñµÄ·â°üÖ®²»Í¬Æ·ÖÊ£¬¶¼ÏêÏ¸ÁÐÔÚÄÇ¸öÏêÏ¸µÃÓÐµã¿Ö²ÀµÄ manual page ÖÐÁË({\ttfamily man iptables})¡£




\section{Ì¸Ì¸ÒªÔõÑù Mangle ·â°ü}

ÏÖÔÚ£¬ÎÒÃÇÖªµÀÈçºÎÈ¥ÌôÑ¡ÄÇÐ©ÎÒÃÇÒª mangle µÄ·â°ü¡£ÎªÁËÒªÍêÉÆÎÒÃÇµÄ¹æÔò£¬ÎÒÃÇÐèÒª×¼È·ÎÞÎóµÄ¸æËßºËÐÄ£¬Ê²÷á²ÅÊÇÎÒÃÇÒª¶Ô·â°ü×öµÄ¡£




\subsection{Source NAT}

ÄúÏëÒª×ö  Source NAT£¬ÊÇÒªÈ¥½«Á¬ÏßµÄÀ´Ô´µØÖ·»»³É±ðµÄÊ²÷áµÄ¡£Õâ¾ÍÒªÔÚËü×îááÒªËÍ³öÈ¥Ö®Ç°£¬ì¶ POSTROUTING Á´ÖÐÍê³ÉÁË£»ÕâÊÇÒ»¸ö·Ç³£ÖØÒªµÄÏ¸½Ú£¬ÒòÎªËüÒâÎ¶ÖøËùÓÐÔÚ Linux Ö÷»ú±¾ÉíÉÏµÄÆäËü¶«Î÷ (routing, packet filtering) ¶¼Ö»¿´¼ûÄÇ¸ö»¹Ã»¸Ä±äµÄ·â°ü¡£Í¬Ê±£¬ÕâÒ²¾ÍÊÇËµ£¬`-o' (´«³ö½çÃæ) Ñ¡Ïî¿ÉÒÔÅÉÉÏÓÃ³¡ÁË¡£



Source NAT ÊÇÓÃ `-j SNAT' À´Ö¸¶¨µÄ£¬Í¬Ê±£¬ `--to source' ÔòÖ¸¶¨Ò»¸ö IP µØÖ·¡¢»òÒ»¶Î IP µØÖ·¡¢ÒÔ¼°Ò»¸ö¿ÉÅäÑ¡µÄ²º¿Ú»òÒ»¶ÎÖµÓòµÄ²º¿Ú(½öÊÊÓÃì¶ UDP ºÍ TCP Ð­¶¨)¡£

\begin{tscreen}
\begin{verbatim}
## Change source addresses to 1.2.3.4.
# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4

## Change source addresses to 1.2.3.4, 1.2.3.5 or 1.2.3.6
# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4-1.2.3.6

## Change source addresses to 1.2.3.4, ports 1-1023
# iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 1.2.3.4:1-1023
\end{verbatim}
\end{tscreen}





\subsubsection{·â°üÎ±×° (Masquerading)}

ÓÐÒ»¸ö Source NAT Ö®ÌØÀý£¬½Ð×ö·â°üÎ±×°£ºËüÖ»ÓÃì¶¶¯Ì¬·ÖÅäµÄ IP µØÖ·£¬ÀýÈç±ê×¼µÄ²¦½Ó(Èç¹ûÓÃ¾²Ì¬ IP µØÖ·£¬ÔòÊ¹ÓÃÇ°ÊöÖ® SNAT)¡£



ÄúÎÞÐèÃ÷È·µØ½« masquerading ·Å½øÀ´Ô´µØÖ·ÄÇÀïÈ¥£ºËü½«»áÊ¹ÓÃ·â°ü´«³ö½çÃæ×÷ÎªÀ´Ô´µØÖ·¡£µ«¸üÖØÒªµÄÊÇ£¬Èç¹û¸ÃÁ¬½Ó(link)¶ÏµôµÄ»°£¬ÄÇ÷áÁ¬Ïß (connections£¬ÎÞ¿É±ÜÃâµÄ½«Ê§µô) Ò²»á±»Íüµô£¬µ±Á¬ÏßÓÃÐÂµÄ IP µØÖ·»ØÀ´µÄÊ±ºò¾Í»áÓÐÎÊÌâÁË¡£

\begin{tscreen}
\begin{verbatim}
## Masquerade everything out ppp0.
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
\end{verbatim}
\end{tscreen}





\subsection{Destination NAT}

Ò»µ©·â°ü½øÈë£¬»áÓÉ PREROUTING Á´Íê³É´¦Àí£»Ò²¾ÍÊÇËµ£¬³ýÁË¸ÃÖ÷»ú×Ô¼ºµÄÆäËü¶«Î÷(ÖîÈç£ºÂ·ÓÉ¡¢·â°ü¹ýÂË) ¶¼½«·â°ü¿´³ÉÒªËÍµ½ `ÕæÕý' Ä¿µÄµØ¡£ÁíÍâ£¬ÄÇ¸ö `-i' (´«Èë½çÃæ) Ñ¡ÏîÒ²¿ÉÒÔÔÚÕâÀïÊ¹ÓÃ¡£



ÐèÒªÐÞ¸Ä±¾»ú²úÉúµÄ·â°üÖ®Ä¿µÄµØµÄ»°£¬ÄÇ÷á OUTPUT Á´¾Í¿ÉÒÔÓÃÉÏÁË£¬²»¹ýÕâ²¢²»³£Åöµ½¡£



Destination NAT ±ØÐëÒÔ `-j DNAT' À´Ö¸¶¨Ê¹ÓÃ£¬Í¬Ê±ÓÃ `--to destination' Ñ¡ÏîÖ¸¶¨Ò»¸ö IP µØÖ·¡¢»òÒ»¶Î IP µØÖ·£¬ÒÔ¼°¿ÉÒÔÅäÑ¡Ò»¸ö²º¿Ú»òÒ»¶Î²º¿ÚÖµÓò(Ö»ÄÜÓÃì¶ UDP ºÍ TCP Ð­¶¨ÉÏÃæ)¡£

\begin{tscreen}
\begin{verbatim}
## Change destination addresses to 5.6.7.8
# iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 5.6.7.8

## Change destination addresses to 5.6.7.8, 5.6.7.9 or 5.6.7.10.
# iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 5.6.7.8-5.6.7.10

## Change destination addresses of web traffic to 5.6.7.8, port 8080.
# iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth1 \
        -j DNAT --to 5.6.7.8:8080

## Redirect local packets to 1.2.3.4 to loopback.
# iptables -t nat -A OUTPUT -d 1.2.3.4 -j DNAT --to 127.0.0.1
\end{verbatim}
\end{tscreen}





\subsubsection{ÖØµ¼Ïò (Redirection)}

ÔÚ Destination NAT  ÓÐÒ»¸öÌØ±ðµÄÇéÐÎ£ºËüÊÇÒ»¸ö¼òµ¥µÄ±ãÀû£¬ÍêÈ«µÈÍ¬ì¶¸ø´«Èë½çÃæµØÖ·×ö DNAT Ò»Ñù¡£

\begin{tscreen}
\begin{verbatim}
## Send incoming port-80 web traffic to our squid (transparent) proxy
# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
        -j REDIRECT --to-port 3128
\end{verbatim}
\end{tscreen}





\subsection{½øÒ»²½µÄÓ³¶Ô(Mappings)}

»¹ÓÐÐí¶à NAT ÉÏÃæµÄ½â¾ö·½°¸ÊÇ´ó¶àÊýÈËÎÞÐèÓÃµ½µÄ¡£ÕâÀï²»·ÁºÍÄÇÐ©ÓÐÐËÈ¤µÄÅóÓÑÌ½ÌÖÒ»ÏÂ£º




\subsubsection{Í¬Ò»¡õÎ§ÄÚµÄ¸´ºÏµØÖ·(Multiple Addresses)Ö®Ñ¡Ôñ¡£}

Èç¹ûÄúÒÑ¾­Ö¸¶¨ÁËÒ»¶Î IP µØÖ·£¬ ¶ø IP µØÖ·µÄÊ¹ÓÃÑ¡ÔñÊÇ»ùì¶»úÆ÷ËùÖªÁ¬ÏßÄ¿Ç°×îÉÙÊ¹ÓÃÖ® IP¡£Ëü¿ÉÒÔÌá¹©×îÔ­Ê¼µÄÆ½ºâ¸ºÔØ(load-balancing)¡£




\subsubsection{½¨Á¢¿Õ NAT Ó³¶Ô}

Äú¿ÉÒÔÊ¹ÓÃ `-j ACCEPT' Ä¿±êÀ´ÈÃÒ»¸öÁ¬ÏßÍ¨¹ý£¬¶øÈÆ¹ý NAT µÄ´¦Àí¡£




\subsubsection{±ê×¼µÄ NAT ÐÐÎª(Behaviour)}

Ô¤ÉèµÄÐÐÎªÊÇÔÚÊ¹ÓÃÕßÖÆ¶¨µÄ¹æÔòÏÞÖÆÄÚ£¬¾¡¿ÉÄÜÉÙµÄ¸Ä±äÁ¬Ïß¡£»»¶øÑÔÖ®£¬·Ç²»µÃÒÑ²»ÒªÖØÓ³¶Ô(remap)²º¿Ú¡£




\subsubsection{¾ø¶ÔÀ´Ô´²º¿ÚÓ³¶Ô}

Èç¹ûÆäËüÁ¬ÏßÒÑ¾­±»Ó³¶Ôµ½ÐÂµÄÁ¬Ïß£¬¾ÍËã¶Ôì¶Ò»¸öÎÞÐè NAT µÄÁ¬ÏßÀ´Ëµ£¬À´Ô´²º¿ÚµÄ×ª»»ÓÐÊ±»òÊÇ±ØÐë¾ø¶Ô´æÔÚµÄ¡£ÈÃÎÒÃÇ¼ÙÉèÒ»¸ö·â°üÎ±×°µÄÇéÐÎ£¬ÕâÒÑ¾­·Ç³£ÆÕ±éÁË£º

\begin{enumerate}
\item  Ò»¸öÍøÒ³Á¬ÏßÓÉÒ»Ì¨ 192.1.1.1 µÄ»úÆ÷´Ó port 1024 ½¨Á¢£¬ÒªÁ¬½Óµ½www.netscape.com port 80¡£
\item  Ëü±»·â°üÎ±×°Ö÷»úÒÔÆä×Ô¼ºµÄ IP µØÖ·(1.2.3.4)½øÐÐÎ±×°¡£
\item  ¸Ã·â°üÎ±×°Ö÷»ú³¢ÊÔÓÉ 1.2.3.4 (ËüµÄÍâ²¿½çÃæµØÖ·) port 1024 À´×öÒ»¸öÍøÒ³Á¬ÏßÖÁwww.netscape.com port 80¡£
\item  È»áá NAT ³ÌÊ½¸Ä±äµÚ¶þ¸öÁ¬ÏßµÄÀ´Ô´²º¿ÚÎª 1025£¬ËùÒÔÕâÁ½¸öÁ¬Ïß²»ÖÁì¶Ïà³å(clash)¡£
\end{enumerate}




µ±Õâ¸ö¾ø¶ÔÀ´Ô´Ó³¶Ô´æÔÚÖ®Ê±£¬²º¿Ú±»²ð·ÖÎªÈý¸öµÈ¼¶£º
\begin{itemize}
\item  512 ÒÔÏÂµÄ²º¿Ú
\item  512 µ½ 1023 Ö®¼äµÄ²º¿Ú
\item  1024 ÒÔÉÏµÄ²º¿Ú
\end{itemize}


ÈÎºÎÒ»¸ö²º¿Ú¶¼²»»á±»¾ø¶ÔÓ³¶Ôµ½²»Í¬µÄµÈ¼¶È¥¡£




\subsubsection{µ± NAT Ê§Ð§Ê±»áÔõÑù£¿}

Èç¹ûÃ»ÓÐ°ì·¨ÈçÓÃ»§ÒªÇóÄÇÑù¶ÀÒ»ÎÞ¶þµØÓ³¶ÔÁ¬Ïß£¬ÄÇ÷áÁ¬Ïß¾Í»á±»µ²µô¡£µ±Ò»¸ö·â°ü²»ÄÜ¹»½ç¶¨ÎªÈÎºÎÁ¬ÏßµÄÊ±ºò£¬½á¹ûÒ²Ò»Ñù£¬ÒòÎªËüÃÇ¿ÉËãÊÇ»ûÐÎµÄ£¬»òÕßÊÇ¸Ã»úÆ÷¼ÇÒäÌåºÄ¹âÁË£¬ÖîÈç´ËÀà¡£




\subsubsection{¸´ºÏÓ³¶Ô¡¢ÖØµþ¡¢ºÍÏà³å(clash)}

Äú¿ÉÒÔÉè¶¨ NAT ¹æÔòÔÚÍ¬Ò»¸ö¡õÎ§Ö®ÉÏÓ³¶Ô·â°ü£»NAT ³ÌÊ½×ãÒÔ´ÏÃ÷µÄÈ¥±ÜÃâÏà³å¡£±È·½Ëµ£¬ÓÃÁ½Ìõ¹æÔò½«  192.168.1.1 ºÍ 192.168.1.2 ÕâÁ½¸öÀ´Ô´µØÖ··Ö±ðÓ³¶Ôµ½ 1.2.3.4£¬ÊÇÍêÈ«¿ÉÐÐµÄ¡£



ÔÙÀ´£¬Äú¿ÉÒÔÓ³¶Ôµ½ÕæÊµµÄ¡¢ÒÑÓÃµÄ IP µØÖ·£¬Ö»ÒªÕâÐ©µØÖ·Í¨¹ýÕâ¸öÓ³¶ÔÖ÷»ú¾ÍÐÐ¡£ËùÒÔ£¬Èç¹ûÄú»ñµÃÒ»¸öÍøÂ·(1.2.3.0/24)£¬µ«ÓÐÒ»¸öÄÚ²¿ÍøÂ·Ê¹ÓÃÕâÐ©µØÖ·£¬¶øÁíÒ»¸öÊ¹ÓÃË½ÓÐµØÖ· 192.168.1.0/24 £¬Äú¾Í¿ÉÒÔ NAT ÄÇÐ© 192.168.1.0/24 µÄÀ´Ô´µØÖ·µ½ 1.2.3.0 ÍøÂ·Ö®ÉÏ£¬¶øÎÞÐèµ£ÐÄÏà³å£º
\begin{tscreen}
\begin{verbatim}
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 \
        -j SNAT --to 1.2.3.0/24
\end{verbatim}
\end{tscreen}




ÕâÍ¬ÑùÊÊÓÃì¶ÄÇÐ© NAT Ö÷»ú×Ô¼ºÊ¹ÓÃµÄµØÖ·£ºÕâÆäÊµ¾ÍÊÇ·â°üÎ±×°ÈçºÎ¹¤×÷µÄÁË(·ÖÏíÎ±×°·â°üµØÖ·ºÍÀ´×ÔÖ÷»ú±¾Éí·â°üÖ® `ÕæÊµ' µØÖ·¡£ )



¸üÉõÕß£¬Äú»¹¿ÉÒÔÓ³¶ÔÏàÍ¬µÄ·â°üµ½Ðí¶à²»Í¬µÄÄ¿±ê(targets)ÉÏÈ¥£¬¶øÇÒËüÃÇ¶¼ÊÇ¹²ÏíµÄ¡£ÀýÈç£¬Èç¹ûÄú²»ÏëÓ³¶ÔÈÎºÎ¶«Î÷µ½ 1.2.3.5 ÉÏÈ¥£¬Äú¿ÉÒÔÕâÑù×ö£º

\begin{tscreen}
\begin{verbatim}
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 \
        -j SNAT --to 1.2.3.0-1.2.3.4 --to 1.2.3.6-1.2.3.254
\end{verbatim}
\end{tscreen}





\subsubsection{¸Ä±ä±¾»ú²úÉúµÄÁ¬ÏßÖ®Ä¿µÄµØ}

Èç¹û±¾»ú²úÉúµÄ·â°üÖ®Ä¿µÄµØ¸Ä±äÁË(ÀýÈç£¬ÓÃ OUTPUT Á´)£¬¶øÕâÑù»áµ¼ÖÂ·â°üÓÉ²»Í¬µÄ½çÃæËÍ³öÈ¥£¬ÕâÑùÀ´Ô´µØÖ·Ò²¸úÖø±äÎªÄÇ¸ö½çÃæ¡£¾ÙÀý×ÓËµ£¬¸Ä±äÒ»¸ö»·»Ø(loopback)·â°üÖ®Ä¿µÄµØÓÉ eth0 ËÍ³ö£¬»áÈÃÀ´Ô´µØÖ·Ò²ÓÉ 127.0.0.1 ±ä³É eth0 µÄµØÖ·£»¶ø²»ÏñÆäËüÀ´Ô´µØÖ·Ó³¶ÔÄÇÑù£¬ÕâÊÇÁ¢¼´Íê³ÉµÄ¡£µ±È»£¬ËùÓÐÕâÐ©Ó³¶ÔÔÚ»ØÓ¦·â°ü½øÈëÊ±ÊÇµßµ¹¹ýÀ´µÄ¡£




\section{ÌØÊâÐ­¶¨}

ÓÐÐ©Ð­¶¨ÊÇ²¢²»ÏëÒª×ö NAT µÄ¡£¶Ôì¶Ã¿Ò»¸öÕâÑùµÄÐ­¶¨¶øÑÔ£¬ÓÐÁ½¸öÑÓÉìÉè¶¨(extension)ÊÇ±ØÐëÒªÐ´Çå³þµÄ£ºÒ»¸öÊÇ¹Øì¶Ð­¶¨Ö®Á¬Ïß×·×Ù£¬ÁíÒ»¸ö¹Øì¶Êµ¼ÊµÄ NAT¡£



ÔÚ netfilter ·¢ÐÐÌ×¼þÀïÃæ£¬ÓÐÒ»Ð©¹Øì¶ ftp µÄÏÖÐÐÄ£×é£ºip\_conntrack\_ftp.o Óë ip\_nat\_ftp.o ¡£Èç¹ûÄú°ÑÕâÐ©²åÈëµ½ÄúµÄºËÐÄÀïÃæ(»òÄúÓÀ¾ÃÐÔµÄ±àÒëËüÃÇ)£¬ÄÇ÷áÒªÔÚ ftp Á¬ÏßÉÏ×öÈÎºÎÖÖÀàµÄ NAT ¶¼ÊÇ¿ÉÐÐµÄ¡£Èç¹ûÄú²»ÕâÑùµÄ»°£¬ÄÇÄú¿ÉÒÔÊ¹ÓÃ±»¶¯Ä£Ê½ ftp£¬²»¹ýÈç¹ûÄúÒª×öÒ»Ð©¶¯×÷Éõì¶¼òµ¥ Source NAT µÄ»°£¬Õâ¾Í¿ÉÄÜ²»ÄÇ÷á¿É¿¿ÁË¡£




\section{NAT µÄÒ»Ð©ÏÞÖÆ (caveats)}

Èç¹ûÔÚÒ»¸öÁ¬ÏßÉÏ×ö NAT£¬ËùÓÐ {\bfseries Ë«Ïò} (´«³öºÍ´«Èë) µÄ·â°ü£¬¶¼±ØÐëÒªÍ¨¹ý NAT Ö÷»ú²ÅÐÐ£¬·ñÔò²¢²»¿É¿¿¡£ÓÈÆäÔÚÁ¬Ïß×·×Ù³ÌÊ½ÖØ×éËéÆ¬ (fragments)µÄÊ±ºò£¬Ò²¾ÍÊÇËµ£¬²»µ«Á¬Ïß×·×Ù»á²»¿ÉÄÜ£¬¶øÇÒÄúµÄ·â°ü¸ù±¾¾Í²»ÄÜÍ¨¹ý£¬ÒòÎªËéÆ¬»á±»µ²ÏÂ¡£




\section{Source NAT ÓëÂ·ÓÉ}

Èç¹ûÄúÒª×ö SNAT£¬Äú»áÏëÒªÈ·¶¨¾­¹ý SNAT ·â°üËù´«¸øµÄÖ÷»ú»á½«»ØÓ¦ËÍ»Ø¸ø NAT Ö÷»ú¡£ÀýÈç£¬Èç¹ûÄúÓ³¶ÔÄ³Ð©´«³ö·â°üµ½À´Ô´µØÖ· 1.2.3.4 Ö®ÉÏ£¬ÄÇ÷áÍâ²¿µÄÂ·ÓÉÆ÷¾Í±ØÐëÖªµÀÒª½«»ØÓ¦·â°ü({\bfseries Ä¿µÄµØ}Îª 1.2.3.4 )ËÍ»Ø¸ø¸ÃÖ÷»ú¡£Õâ¿ÉÒÔÓÃÈçÏÂ·½·¨×öµ½£º

\begin{enumerate}
\item  Èç¹ûÄúÒªÔÚÖ÷»ú×Ô¼ºµÄµØÖ·(Â·ÓÉºÍÆäËüËùÓÐÔË×÷½ÔÕý³£)ÉÏÃæ×ö SNAT£¬ÄúÎÞÐè×öÈÎºÎ¶¯×÷¡£
\item  Èç¹ûÄúÒªÔÚÒ»¸öÔÚ±¾»úÍøÂ·ÉÏÉÐÎ´Ê¹ÓÃµÄµØÖ·×ö SNAT(ÀýÈç£¬Ó³¶Ôµ½ÔÚ 1.2.3.0/24 ÍøÂ·ÉÏµÄÒ»¸ö¿ÉÓÃ IP 1.2.3.99)£¬ÄúµÄ NAT Ö÷»ú¾ÍÐèÒª»ØÓ¦¹Øì¶¸ÃµØÖ·µÄ ARP ÇëÇó£¬Ò»ÈçËü×Ô¼º±¾ÉíµÄÒ»Ñù£º×î¼òµ¥µÄ·½·¨¾ÍÊÇ½¨Á¢ IP alias£¬ÀýÈç£º
\begin{tscreen}
\begin{verbatim}
# ip address add 1.2.3.99 dev eth0
\end{verbatim}
\end{tscreen}

\item  Èç¹ûÄúÒªÔÚÒ»¸öÍêÈ«²»Í¬µÄµØÖ·ÉÏ×ö SNAT£¬Äú¾ÍÒªÈ·¶¨ SNAT ·â°üµÖ´ïµÄ»úÆ÷ÄÜ¹»Â·ÓÉ»Ø¸Ã NAT Ö÷»ú¡£Èç¹û NAT Ö÷»úÊÇËüÃÇµÄÔ¤ÉèÕ¢µÀÆ÷µÄ»°£¬ÊÇ¿ÉÒÔ×öµ½µÄ£¬·ñÔò£¬Äú¾ÍÒª¹ã¸æ(advertize )Ò»¸öÂ·ÓÉ(Èç¹ûÅÜÂ·ÓÉÐ­¶¨µÄ»°)£¬»òÊÇÊÖ¹¤µÄÔÚÃ¿Ò»Ì¨²ÎÓë»úÆ÷ÉÏÔö¼ÓÂ·ÓÉ¡£
\end{enumerate}





\section{ÔÚÍ¬Ò»ÍøÂ·ÉÏµÄ Destination NAT }

Èç¹ûÄúÒª×ö portforwarding »Øµ½Í¬Ò»¸öÍøÂ·£¬ÄúÒªÈ·¶¨Ç°ÏòºÍ»ØÓ¦·â°üË«·½¶¼¾­¹ý¸Ã NAT Ö÷»ú(ÕâÑùËüÃÇ²ÅÄÜ±»ÐÞ¸Ä)¡£NAT ³ÌÊ½´ÓÏÖÔÚ¿ªÊ¼(2.4.0-test6ÒÔáá)£¬»áµ²µôááÃæÇéÐÎËù²úÉúµÄ´«³ö ICMP ÖØµ¼Ïò£ºÄÇÐ©ÒÑ¾­ NAT µÄ·â°üÒÔËüËù½øÈëµÄÏàÍ¬½çÃæ´«³ö£¬¶ø½ÓÊÕ¶ËËÅ·þÆ÷ÈÔ³¢ÊÔÖ±½Ó»ØÓ¦µ½¿Í»§¶Ë(²»ÈÏ¿É¸Ã»ØÓ¦)¡£



¾­µäµÄÇéÐÎÊÇÄÚ²¿ÈËÔ±³¢ÊÔÁ¬½Óµ½ÄúµÄ `¹«ÓÐ(public)' ÍøÕ¾ËÅ·þÆ÷£¬Êµ¼ÊÉÏÊÇ´Ó¹«ÓÐµØÖ·(1.2.3.4) DNAT µ½Ò»¸öÄÚ²¿µÄ»úÆ÷(192.168.1.1)È¥£¬¾ÍÏñÕâÑù£º

\begin{tscreen}
\begin{verbatim}
# iptables -t nat -A PREROUTING -d 1.2.3.4 \
        -p tcp --dport 80 -j DNAT --to 192.168.1.1
\end{verbatim}
\end{tscreen}




Ò»¸ö·½·¨ÊÇÅÜÒ»Ì¨ÄÚ²¿ DNS ËÅ·þÆ÷£¬ËüÖªµÀÄúµÄ¹«ÓÐÍøÕ¾µÄÕæÕý(ÄÚ²¿) IP µØÖ·£¬¶ø½«ÆäËüÇëÇó×ª´«¸øÍâ²¿µÄ DNS ËÅ·þÆ÷¡£»»¶øÑÔÖ®£¬¹Øì¶ÄúÍøÕ¾ËÅ·þÆ÷µÄ¼ÇÂ¼»áÕýÈ·µØÏÔÊ¾ÎªÄÚ²¿ IP µØÖ·¡£



¶øÁíÒ»¸ö·½·¨ÊÇÍ¬Ê±ÈÃÕâÌ¨ NAT Ö÷»ú½«¸ÃµÈÁ¬ÏßÖ®À´Ô´ IP µØÖ·Ó³¶ÔÎªËü×Ô¼ºµÄµØÖ·£¬ÎÒÃÇ¿ÉÒÔÏñÈçÏÂÄÇÑù×ö(¼ÙÉè NAT Ö÷»úÖ®ÄÚ²¿ IP µØÖ·Îª 192.168.1.250)£º

\begin{tscreen}
\begin{verbatim}
# iptables -t nat -A POSTROUTING -d 192.168.1.1 -s 192.168.1.0/24 \
        -p tcp --dport 80 -j SNAT --to 192.168.1.250
\end{verbatim}
\end{tscreen}


ÒòÎª {\bfseries PREROUTING} ¹æÔòÊÇ×îÏÈÖ´ÐÐµÄ£¬¶ÔÄÚ²¿ÍøÕ¾ËÅ·þÆ÷¶øÑÔ£¬·â°ü¾ÍÒÑ¾­±»¶¨ÏòºÃÁË£ºÎÒÃÇ¿ÉÒÔÄÚ¶¨ºÃÄÄ¸öÎªÀ´Ô´ IP µØÖ·¡£




\section{¸ÐÐ»}

Ê×ÏÈ¸ÐÐ»ÔÚÎÒ¹¤×÷ÆÚ¼äÏàÐÅ netfilter µÄ¹¹Ïë²¢Ö§³ÖÎÒµÄ WatchGuard ºÍ David Bonn¡£



ÒÔ¼°ËùÓÐÆäËû°ïÎÒÖ¸Õý NAT Ö®²»×ãµÄÅóÓÑ£¬ÓÈÆäÊÇÄÇÐ©¶Á¹ýÎÒµÄÈÕ¼ÇµÄ¡£



Rusty.

\end{document}
