防火墙端口转发操作手册<二>
二．网络环境
注：Linux网关服务器（防火墙）和客户机是公网，WEB服务器在内网
1． 使用虚拟机虚拟两台LINUX服务器，一台角色为防火墙，另一台角色为公网web服务器
防火墙需要虚拟出来两块网卡，eth0 : 218.29.30.31/24 , eth1: 192.168.1.1/24
Web服务器一块网卡eth0：192.168.1.6/24
2． 使用真实机做内网客户端，用一块真实网卡IP为218.29.30.29/24
3． web服务器上设置
[root@kingmacro /]#iptables –F
[root@kingmacro /]#service iptables save
[root@kingmacro /]#chkconfig httpd on
[root@kingmacro /]#service httpd start
[root@kingmacro /]#vim /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
HWADDR=00:0c:29:50:9f:5c
NM_CONTROLLED=yes
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.1.6
NETMASK=255.255.255.0
4. 防火墙设置
[root@wanghong ~]# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth1
[root@wanghong ~]#vim /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
HWADDR=00:0c:29:cf:82:fe
NM_CONTROLLED=yes
ONBOOT=yes
BOOTPROTO=none
IPADDR=218.29.30.31
NETMASK=255.255.255.0
[root@wanghong ~]#vim /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
NM_CONTROLLED=yes
ONBOOT=yes
BOOTPROTO=none
IPADDR=192.168.1.1
NETMASK=255.255.255.0
[root@wanghong ~]#service network restart
[root@wanghong ~]#vim /etc/sysctl.conf
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0
# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1
# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1
[root@wanghong ~]#sysctl -p
[root@wanghong ~]#iptables -t nat -A PREROUTING -i eth0 -d 218.29.30.31 -p tcp --dport 80 -j DNAT –to-destiantion 192.168.1.6
[root@wanghong ~]#iptables -t nat -L
5.防火墙测试
直接使客户端ping命令，ping防火墙服务器eth0可以正常通读，ping 端口eth1不能正常ping通 ，ping web服务器也是拼不通的（这些状况都属正常情况），因为在端口eth0上做了端口转发，也就是所有来自eth0 80端口的数据包全部直接转发给wed服务器192.168.1.6 （注：在此实验过程当中，web服务器需要加内部网关192.168.1.1）
使用浏览器访问web服务器, http://192.168.1.6
