iptables DNAT端口转发到LAN上的另一台机器

我试图执行iptables转发规则，以便内部redirect通过特定端口的数据包。

我的机器正在Ubuntu Server 12.04.3下运行，包含UFW和所有最新的更新。

到目前为止，我能够build立一个部分工作的设置，如下所示：

iptables -A PREROUTING -t nat -p tcp --dport 40591 -j DNAT --to 192.168.0.100:40591 iptables -A ufw-user-forward -p tcp -d 192.168.0.100 --dport 40591 -j ACCEPT iptables -t nat -A POSTROUTING -j MASQUERADE iptables -A ufw-user-forward -m state --state RELATED,ESTABLISHED -j ACCEPT

如块所示，目标收件人是192.168.0.100和端口40591 。

然而，不久之后就出现了问题，我注意到我的apache2服务正在输出很多错误; 我的PHP脚本不能再通过127.0.0.1连接到我的数据库，因为连接据称是从它的LAN地址（192.168.0.10 ）开始的。

为了确认问题的根源，我曾尝试过：

把我的PHP脚本整理一下，但是除了确认我已经知道的东西（即连接在本地启动并魔法偏转到服务器的本地地址（ 192.168.0.10 ））之外没有确凿的信息被吐出
使用命令tcpdump -e -i any -n -s0 tcp port 3306在端口3306上执行tcpdump -ing

tcpdump的

之前（添加规则）

 04:51:30.043660 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [S], seq 1373736824, win 43690, options [mss 65495,sackOK,TS val 33638495 ecr 0,nop,wscale 7], length 0 04:51:30.043679 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [S.], seq 3532787939, ack 1373736825, win 43690, options [mss 65495,sackOK,TS val 33638495 ecr 33638495,nop,wscale 7], length 0 04:51:30.043692 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [.], ack 1, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 0 04:51:30.043935 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 163: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 1:96, ack 1, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 95 04:51:30.043992 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [.], ack 96, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 0 04:51:30.044044 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 173: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 1:106, ack 96, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 105 04:51:30.044077 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [.], ack 106, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 0 04:51:30.044152 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 79: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 96:107, ack 106, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 11 04:51:30.044240 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 115: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 106:153, ack 107, win 342, options [nop,nop,TS val 33638495 ecr 33638495], length 47 04:51:30.044560 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 413: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 107:452, ack 153, win 342, options [nop,nop,TS val 33638496 ecr 33638495], length 345 04:51:30.052507 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 204: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 153:289, ack 452, win 350, options [nop,nop,TS val 33638498 ecr 33638496], length 136 04:51:30.052907 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 471: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 452:855, ack 289, win 350, options [nop,nop,TS val 33638498 ecr 33638498], length 403 04:51:30.053042 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 302: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 289:523, ack 855, win 359, options [nop,nop,TS val 33638498 ecr 33638498], length 234 04:51:30.092217 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 79: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [P.], seq 855:866, ack 523, win 359, options [nop,nop,TS val 33638507 ecr 33638498], length 11 04:51:30.092377 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 73: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [P.], seq 523:528, ack 866, win 359, options [nop,nop,TS val 33638508 ecr 33638507], length 5 04:51:30.092404 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [F.], seq 528, ack 866, win 359, options [nop,nop,TS val 33638508 ecr 33638507], length 0 04:51:30.092427 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46461: Flags [F.], seq 866, ack 529, win 359, options [nop,nop,TS val 33638508 ecr 33638508], length 0 04:51:30.092446 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.46461 > 127.0.0.1.3306: Flags [.], ack 867, win 359, options [nop,nop,TS val 33638508 ecr 33638508], length 0

后

 04:32:38.264052 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [S], seq 344014396, win 43690, options [mss 65495,sackOK,TS val 33355550 ecr 0,nop,wscale 7], length 0 04:32:38.264072 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 76: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [S.], seq 1406967667, ack 344014397, win 43690, options [mss 65495,sackOK,TS val 33355550 ecr 33355550,nop,wscale 7], length 0 04:32:38.264086 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [.], ack 1406967668, win 342, options [nop,nop,TS val 33355550 ecr 33355550], length 0 04:32:38.264337 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 141: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [P.], seq 1:74, ack 1, win 342, options [nop,nop,TS val 33355551 ecr 33355550], length 73 04:32:38.264388 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [F.], seq 74, ack 1, win 342, options [nop,nop,TS val 33355551 ecr 33355550], length 0 04:32:38.264450 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [.], ack 74, win 342, options [nop,nop,TS val 33355551 ecr 33355551], length 0 04:32:38.264488 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 192.168.0.10.46454 > 127.0.0.1.3306: Flags [F.], seq 0, ack 75, win 342, options [nop,nop,TS val 33355551 ecr 33355551], length 0 04:32:38.264506 In 00:00:00:00:00:00 ethertype IPv4 (0x0800), length 68: 127.0.0.1.3306 > 127.0.0.1.46454: Flags [.], ack 2, win 342, options [nop,nop,TS val 33355551 ecr 33355551], length 0

Ergo，我的设置已经过时，我不太清楚如何使用iptables规则来实现一个稳定的NAT-ed转发设置。

所以我的问题是：是什么原因造成这个问题，我该如何补救？

谢谢。

目前还不清楚，如果你在单宿主机或双宿主机器上这样做。你没有在你的iptables规则中指定任何接口，这让我感到困惑。

它看起来像iptables -t nat -A POSTROUTING -j MASQUERADE规则是你的罪魁祸首。这将导致所有接口上的传出stream量被SNAT到接口的IP地址。我不认为你需要这个。您应该将该规则的面向Internet的界面指定为-o界面。