iptables 端口转发(CentOS)
注意：一来一去
在中转服务器操作
不同端口转发
本地网络连接的端口依旧是10010，而不是10086
$ iptables -t nat -A PREROUTING -p tcp -m tcp --dport 10010 -j DNAT --to-destination 103.79.78.76:10086$ iptables -t nat -A POSTROUTING -p tcp -m tcp -d 103.79.78.76 --dport 10086 -j SNAT --to-source 183.60.100.8ufw端口转发(Ubuntu)
编辑 etc/default/ufw文件中更改参数DEFAULT_FORWARD_POLICY
1 default_forward_policy = "accept"
配置/etc/ufw/sysctl.conf 允许ipv4转发（默认情况下，参数被注释掉）。如果你想要ipv6取消注释。
123 net/ipv4/ip_forward=1#net/ipv6/conf/default/forwarding=1#net/ipv6/conf/all/forwarding=1最后一步是添加NAT到/etc/ufw/before.rules的配置。将以下内容添加到过滤器规则（*filter）之前
1234567891011 # NAT Table rules #2017/10/11*nat:PREROUTING ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]# Port Forwardings -A PREROUTING -p tcp --dport 10010 -j DNAT --to-destination 103.79.78.76-A POSTROUTING -p tcp -d 103.79.78.76 --dport 10010 -j SNAT --to-source 183.60.100.8# don't delete the 'COMMIT' line or these rules won't be processedCOMMIT注意*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。
现在通过重新启动ufw启用更改。
1 sudo ufw disable && sudo ufw enable查看iptables生效状态
在中转服务器查看:
iptables -t nat -L -v
///
ubuntu下的ufw
ubuntu为了方面使用对底层的iptables做了一层配置简化，底层机制还是iptables,通过iptables可以请求实现端口映射、nat等，下面对ufw的配置做描述
安装: sudo apt install ufw
启动: sudo ufw ebable
停止: sudo ufw disable
状态: sudo ufw status
重载：sudo ufw reload
主要配置文件：
1、/etc/default/ufw
2、/etc/ufw/sysctl.conf
3、/etc/ufw/before.rules
说明：
1、ufw默认是将filter的input设置成了DROP，也就是说如果开启防火墙，默认情况下外部不能主动访问该节点了，所有需要修改INPUT策略，可以直接将 DEFAULT_INPUT_POLICY设置为ACCEPT
2、除了用 ufw命令或上面的配置文件外，原来的iptables命令也同样是有效的，实际上ufw的配置规则和iptables基本也一样
配置端口映射举例，
例如将8554映射到192.168.4.99:554，
本机的对外口为192.168.35.50，内网为192.168.4.102
方法一：iptables配置:
sudo iptables -t nat -A PREROUTING -p tcp --dport 8554 -j DNAT --to-destination 192.168.4.99:554
sudo iptables -t nat -A POSTROUTING -d 192.168.4.99 -p tcp --dport 554 -j SNAT --to-source 192.168.4.102
sudo iptables -A FORWARD -j ACCEPT
将net/ipv4/ip_forward设置为1
方法二：ufw配置
1、/etc/ufw/sysctl.conf中将net/ipv4/ip_forward设置为1
2、/etc/default/ufw中将DEFAULT_INPUT_POLICY设置为ACCEPT
3、/etc/default/ufw中将DEFAULT_FORWARD_POLICY设置为ACCEPT
4、修改/etc/ufw/before.rules，添加nat规则，在最后添加
*nat
:PREROUTING - [0:0]
:POSTROUTING - [0:0]
-A PREROUTING -p tcp --dport 8554 -j DNAT --to-destination 192.168.4.99:554
-A POSTROUTING -d 192.168.4.99 -p tcp --dport 554 -j SNAT --to-source 192.168.4.102
COMMIT
///
/// 91V 代理从机网页方法 ///
本地网络 >> 中转IP:192.168.44.100 >> 目标IP:1192.168.44.101
//参考链接：https://blog.csdn.net/maxuearn/article/details/104824898
*nat
:PREROUTING - [0:0]
:POSTROUTING - [0:0]
-A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.44.101:80
-A PREROUTING -p tcp --dport 6692 -j DNAT --to-destination 192.168.44.101:6692
-A POSTROUTING -p tcp -d 192.168.44.101 --dport 80 -j SNAT --to-source 192.168.44.100
-A POSTROUTING -p tcp -d 192.168.44.101 --dport 6692 -j SNAT --to-source 192.168.44.100
COMMIT
注意事项：
（1）*nat，以COMMIT结尾才会生效。*filter一个COMMIT,*nat一个COMMIT。不能总用一个COMMIT。
（2）配置完成，需要通过重新启动ufw启用更改，使之生效。
sudo ufw disable && sudo ufw enable
（3）GEAC91V，从机需要修改net.xml配置文件中的websocket通信端口号，6691->6692, web页面中的通信端口号也要同步修改：6691->6692
路径：cd /usr/local/mec/www/src/views/mec/js
/ 以下为修改后的 before.rules 内容///
## rules.before## Rules that should be run before the ufw command line added rules. Custom# rules should be added to one of these chains:# ufw-before-input# ufw-before-output# ufw-before-forward## Don't delete these required lines, otherwise there will be errors*filter:ufw-before-input - [0:0]:ufw-before-output - [0:0]:ufw-before-forward - [0:0]:ufw-not-local - [0:0]# End required lines# allow all on loopback-A ufw-before-input -i lo -j ACCEPT-A ufw-before-output -o lo -j ACCEPT# quickly process packets for which we already have a connection-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT# drop INVALID packets (logs these in loglevel medium and higher)-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny-A ufw-before-input -m conntrack --ctstate INVALID -j DROP# ok icmp codes for INPUT-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT# ok icmp code for FORWARD-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT# allow dhcp client to work-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT## ufw-not-local#-A ufw-before-input -j ufw-not-local# if LOCAL, RETURN-A ufw-not-local -m addrtype --dst-typ极速赛车五码稳赢技巧ED,ESTABLISHED -j ACCEPT-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT# drop INVALID packets (logs these in loglevel medium and higher)-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny-A ufw-before-input -m conntrack --ctstate INVALID -j DROP# ok icmp codes for INPUT-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT# ok icmp code for FORWARD-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT# allow dhcp client to work-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT## ufw-not-local#-A ufw-before-input -j ufw-not-local# if LOCAL, RETURN-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN# if MULTICAST, RETURN-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN# if BROADCAST, RETURN-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN# all other non-local packets are dropped-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny-A ufw-not-local -j DROP# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above# is uncommented)-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above# is uncommented)-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT# don't delete the 'COMMIT' line or these rules won't be processedCOMMIT*nat:PREROUTING - [0:0]:POSTROUTING - [0:0]-A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.44.101:80-A PREROUTING -p tcp --dport 6692 -j DNAT --to-destination 192.168.44.101:6692-A POSTROUTING -p tcp -d 192.168.44.101 --dport 80 -j SNAT --to-source 192.168.44.100-A POSTROUTING -p tcp -d 192.168.44.101 --dport 6692 -j SNAT --to-source 192.168.44.100COMMIT
参考：配置iptables、ufw端口转发_maxuearn的博客-CSDN博客_ufw端口转发