iptables

kak s pomo6tta na iptables da prepratq celiq traffic idva6t kum vhodq6tiq interfeis kum daden host , probvah taka ama ne 6te :

iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 172.16.1.123

172.16.1.123 -tova e ip-to kum koeto iskam da pra6tam

pusnal sum ip prepra6tane :)
10x predvaritelno

iptables -A PREROUTING -t nat -p tcp -d 1.1.1.1 -j DNAT --to 2.2.2.2
1.1.1.1 - vhod

da primera 6te sraboti no ne i v moq slu4ai , prosto ne obqsnih vsi4ko pravilno.
az sum s vutr6no ip i iskam da maskiram i prepra6tam kum vutre6no ip , toest DNAT ne mi vur6i rabota (6toto na nego za vhodq6t interfeis mu trqbva realno ip), taka 4e 4akam novi predlojeniq

Е как си представяш да препращаш пакети, които въобще не могат да стигнат до тебе?

hahaha , ne si 4el vnimatelno , 6te prepra6tam moq si trafik taka 4e vqrvai mi ima takiva paketi , vse pak i az sum svurzan kum gateway prez koito komunikiram s internet

ми направи snat, а не dnat

Маи и ти не си чел достатъчно след като не знаеш, че няма никакво значение дали си с рутируемо или не IP, пък и в системни администратори на същата темичка кочто си заформил са ти дали много добри и точни отговори.

П.С. Прочети мануала на iptables, седни пред пц-то и се замисли с новопридобитите знания КАКВО точно ИСКАШ да направиш, и го направи.

По този въпрос съществуват две мнения. Едното е неправилно, а другото е моето.

ne znam kolko simwola pozwolqwa towa chudo:
Example
iptables -t nat -A PREROUTING -p tcp -d 15.45.23.67 --dport 80 -j DNAT --to-destination 192.168.1.1-192.168.1.10
Explanation
The --to-destination option tells the DNAT mechanism which Destination IP to set in the IP header, and where to send packets that are matched. The above example would send on all packets destined for IP address 15.45.23.67 to a range of LAN IP's, namely 192.168.1.1 through 10. Note, as described previously, that a single stream will always use the same host, and that each stream will randomly be given an IP address that it will always be Destined for, within that stream. We could also have specified only one IP address, in which case we would always be connected to the same host. Also note that we may add a port or port range to which the traffic would be redirected to. This is done by adding, for example, an :80 statement to the IP addresses to which we want to DNAT the packets. A rule could then look like --to-destination 192.168.1.1:80 for example, or like --to-destination 192.168.1.1:80-100 if we wanted to specify a port range. As you can see, the syntax is pretty much the same for the DNAT target, as for the SNAT target even though they do two totally different things. Do note that port specifications are only valid for rules that specify the TCP or UDP protocols with the --protocol option.
-------------------------------------------
Example
iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to-source 194.236.50.155-194.236.50.160:1024-32000
Explanation
The --to-source option is used to specify which source the packet should use. This option, at its simplest, takes one IP address which we want to use for the source IP address in the IP header. If we want to balance between several IP addresses, we can use a range of IP addresses, separated by a hyphen. The --to--source IP numbers could then, for instance, be something like in the above example: 194.236.50.155-194.236.50.160. The source IP for each stream that we open would then be allocated randomly from these, and a single stream would always use the same IP address for all packets within that stream. We can also specify a range of ports to be used by SNAT. All the source ports would then be confined to the ports specified. The port bit of the rule would then look like in the example above, :1024-32000. This is only valid if -p tcp or -p udp was specified somewhere in the match of the rule in question. iptables will always try to avoid making any port alterations if possible, but if two hosts try to use the same ports, iptables will map one of them to another port. If no port range is specified, then if they're needed, all source ports below 512 will be mapped to other ports below 512. Those between source ports 512 and 1023 will be mapped to ports below 1024. All other ports will be mapped to 1024 or above. As previously stated, iptables will always try to maintain the source ports used by the actual workstation making the connection. Note that this has nothing to do with destination ports, so if a client tries to make contact with an HTTP server outside the firewall, it will not be mapped to the FTP control port.

Obshtiqt sluchai e !
imash edna mashina s dve mrejovi karti i dve IP-ta realno (1.2.3.4 eth0) i private (192.168.0.1 eth1) i vtora mash s private IP (192.16.0.2).
iskash da pravish FORWARD perz purvata mashin kum vtorata :)
Nekada go uslojnim neka da ogranichavame vtorata mashina i po MAC addres primerno (ff:02:B3:4C:24:ff)

#!/bin.sh
#
# za zatvorim ustata na drugite shoto te nakarah da pishesh gluposti
iptables -F
iptables -F -t nat

#Da zabranim FORWARD na vsichki
iptables -P FORWARD DROP

#da razreshim FORWARD na izbran ot nas PC
iptables -A FORWARD -s 192.168.0.2/32 -m mac --mac-source ff:02:B3:4C:24:ff -j ACCEPT
iptables -A FORWARD -d 192.168.0.2/32 -j ACCEPT

#sega ako iskame da maskirame sorsa na iztochnika sus sors na eth1 i da polzvame
#routing tablicata koiato si e po default za da ne pravim druza za usera pravim slednoto
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE

#sega za da vidim kakva sme q svarshili
iptables -L
iptables -L -t nat

#END

#i da ne zabravim NAI vajnoto :)
echo "Enabling IPv4 packet forwarding."
echo 1 > /proc/sys/net/ipv4/ip_forward

-------------------------------------------
ako ne ti trqbva tochno takuv primer izqsni po tochno kakvo iskash
a ako primera te ustroiva ...... USPEH!

sushtoto stava ako purvata mashina e samo s edna mrejova karta
NO ! ne zabravqi che ako purvata mashina e real IP a vtorata s PRIVATE malko trudno biha se vijdali edna druga zatova purvata mashina trqbva da ima vdignato IP ot mrejata na vtorata zashtoto tq purvata se qvqva geteway na vtorata :)
breh kolko slojno go kazah
A beh tragnal da ti obqsnqvam che ako na puirvata imash samo edno IP i edna eth0 samo to mahash samo vtoriqt MASQ... i kapish