我试图redirect端口102上的所有TCP通信从一个IP地址到另一个IP地址，并希望伪装IP
即时通讯使用这个iptableconfiguration，但仍然无法连接。
iptables -t nat -A PREROUTING -s 195.190.131.189 -d 195.190.131.180 -p tcp --dport 102 -j DNAT --to 192.168.251.10:102 iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 102 -j MASQUERADE iptables -t nat -I POSTROUTING 1 -p tcp --dport 102 -j LOG --log-level 2 iptables -t nat -I PREROUTING 1 -p tcp --dport 102 -j LOG --log-level 2 iptables -t nat -I OUTPUT 1 -p tcp --dport 102 -j LOG --log-level 2 iptable -t nat -L -nv显示
Chain PREROUTING (policy ACCEPT 5 packets, 292 bytes) pkts bytes target prot opt in out source destination 3 152 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2 3 152 DNAT tcp -- * * 195.190.131.189 195.190.131.180 tcp dpt:102 to:192.168.251.10:102 Chain POSTROUTING (policy ACCEPT 11 packets, 660 bytes) pkts bytes target prot opt in out source destination 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2 0 0 MASQUERADE tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 Chain OUTPUT (policy ACCEPT 11 packets, 660 bytes) pkts bytes target prot opt in out source destination 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:102 LOG flags 0 level 2
所以从我的理解，数据包被发送到DNAT。
消息日志不显示输出接口是否是一个问题：
Sep 24 20:14:28 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=6511 DF PROTO=TCP SPT=53696 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0 Sep 24 20:19:18 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=6701 DF PROTO=TCP SPT=53709 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0 Sep 24 20:19:21 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=6703 DF PROTO=TCP SPT=53709 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0 Sep 24 20:19:27 appsgh kernel: IN=eth0 OUT= MAC=00:50:56:8a:70:12:00:50:56:8a:74:02:08:00 SRC=195.190.131.189 DST=195.190.131.180 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=6707 DF PROTO=TCP SPT=53709 DPT=102 WINDOW=8192 RES=0x00 SYN URGP=0
你想这样做吗？
{}客户端（port_random）—–（port12345）{}你（port_random）—–（port4321）{} 111.111.111.111
iptables -t nat -A PREROUTING -p tcp --dport 12345 -j DNAT --to-destination 111.111.111.111:4321 iptables -A FORWARD -p tcp -d 111.111.111.111 --dport 4321 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -d 111.111.111.111 -o eth0 -j MASQUERADE