服务器 Gind.cn
  1. 服务器 Gind.cn
  3. IPTables允许一个IP访问端口22并将端口22redirect到555
Intereting Posts
备份ADAM数据库 – 发生locking 如何在ESXi的本地磁盘上获取SMART信息？ Windows磁盘映像备份与自动调度 PHP致命错误Zend未捕获的exception Exchange 2010在多个虚拟机上的angular色 haproxy'd mysql客户端挂起尝试连接 如果存储过程在SSMS中运行并且崩溃，会发生什么情况？ 睡眠模式对服务器有好处吗？ Nginx代理运行在不同的CoreOS节点上的许多容器 关于巩固助手的问题 – 0 为什么7层负载均衡器无法通过SSL终止？ 如何通过网桥将VLANstream量传递给KVM虚拟机 如何更改Zebra ZM600打印机的SNMP社区名称？ 当我通过负载平衡器访问它时，Nginx将redirect改变为错误的端口 提取，合并和自动化几个安装程序

IPTables允许一个IP访问端口22并将端口22redirect到555

我有我的SSH服务器侦听端口555.我需要允许一个IP连接到端口22，然后让IPTablesredirect到555（这是因为连接到端口22的软件只能连接到端口22） 。

我目前的IPTables规则如下： 

Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:bootps ACCEPT tcp -- anywhere anywhere tcp dpt:bootps ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:bootps ACCEPT tcp -- anywhere anywhere tcp dpt:bootps ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere tcp dpt:ms-wbt-server ACCEPT tcp -- anywhere anywhere state NEW tcp multiport dports 5901:5903,6001:6003 DROP tcp -- anywhere anywhere tcp dpt:telnet DROP tcp -- anywhere anywhere tcp dpt:telnet DROP tcp -- anywhere anywhere tcp dpt:sunrpc DROP tcp -- anywhere anywhere tcp dpt:ircu-2 DROP tcp -- anywhere anywhere tcp dpt:ircu-3 DROP tcp -- anywhere anywhere tcp dpt:ircu-4 DROP tcp -- anywhere anywhere tcp dpt:ircu-5 DROP tcp -- anywhere anywhere tcp dpt:telnet DROP tcp -- anywhere anywhere tcp dpt:ms-wbt-server DROP tcp -- anywhere anywhere tcp dpt:5666 DROP tcp -- anywhere anywhere tcp dpt:5903 Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere 192.168.100.0/24 ACCEPT all -- 192.168.100.0/24 anywhere ACCEPT all -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable REJECT all -- anywhere anywhere reject-with icmp-port-unreachable ACCEPT all -- anywhere 192.168.122.0/24 state RELATED,ESTABLISHED ACCEPT all -- 192.168.122.0/24 anywhere ACCEPT all -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable REJECT all -- anywhere anywhere reject-with icmp-port-unreachable TCPMSS tcp -- 172.16.36.0/24 anywhere tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1356 Chain OUTPUT (policy ACCEPT) target prot opt source destination

我是否正确地说，下列规则将做我想要的？ （假设192.168.8.8是我想要连接到22的IP）。 

  iptables -A INPUT -s 192.168.8.8 -p tcp -m tcp --dport 22 -j ACCEPT iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 678

任何帮助表示赞赏。 谢谢！

如果你想让它redirect到555端口，你应该使用 

 iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 555

代替 

 iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 678

除此之外，你的规则是正确的。

此外，使用当前的configuration，您将不需要INPUT规则，因为您目前不阻止连接到端口22（您的INPUT策略设置为ACCEPT ）。