论坛风格切换切换到宽版
  • 1142阅读
  • 9回复

[问题求助]多个外网IP的NAT问题 [复制链接]

上一主题 下一主题
离线lj790816.
 
发帖
1941
C币
-139573
威望
326
贡献值
1
银元
0
铜钱
4299
人人网人气币
0
只看楼主 倒序阅读 使用道具 楼主  发表于: 2009-05-01
我服务器30个IP 用 RHEL4+PPT.PD+MPPE补丁 做的V.PN    外汇
客户150个
想实现5个内网用户nat到一个公网I.P上,.
用iptables怎么实现?

搜索了好几天资料
也没找到确切的解决办法

VPN板块也没人。所以.发到这里来碰碰运气           鲜花

评价一下你浏览此帖子的感受

精彩

感动

搞笑

开心

愤怒

无聊

灌水
离线wdyzl1.
发帖
1973
C币
-60986
威望
347
贡献值
1
银元
-2
铜钱
4370
人人网人气币
0
只看该作者 沙发  发表于: 2010-04-13
假设:
你的公网IP是 xxx.xxx.xxx.n1-n2 (一共30个连续的IP)
外网卡是eth0
150个内网用户的IP是192.168.0.1-192.168.0.150
for((i=n1;i<=n2;i++))

do

   ip addr add xxx.xxx.xxx.${i} dev eth0

done

#第一个循环,添加IP(需要iproute2这个软件包),如果已经使用其他的方式,比如系统的网卡配置工具设置过那30个IP,就可以不要这个循环了



iptables -t nat -F POSTEROUTING  #清空原来POSTROUTING链中的所有规则,(这个需要视情况而定)





for((i=1;i<=150;i++))

do

   ((j=(i-1)/5+n1))

   iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.${i} -j SNAT --to xxx.xxx.xxx.${j}

done

#第二个循环,按照顺序,每5个IP,映射到一个外网IP上

((  )) 这是一个计算标志,表示内部是进行算术运算

j=(i-1)/5+n1       (i-1)/5 能够保证每5个IP获取到不同的j值,bash中的计算是取整的, +n1 就是映射到实际的那个IP上(原来的程序部分有错误,在此修正

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to xxx.xxx.xxx.${j}  此处${j} 会使用j实际的值进行替换,然后再执行iptables命令
复制代码

不知是否可行?


修改原因:添加说明和修正部分错误

[ 本帖最后由 springwind426 于 2007-10-19 09:03 编辑 ]

离线nyqs.
发帖
2106
C币
-132410
威望
378
贡献值
1
银元
-3
铜钱
4648
人人网人气币
0
只看该作者 板凳  发表于: 2010-04-13
我是新手
烦请老大告诉我这些代码怎么用。呵呵

离线dyy0214.
发帖
2060
C币
-60444
威望
372
贡献值
1
银元
0
铜钱
4565
人人网人气币
0
只看该作者 地板  发表于: 2010-04-13


QUOTE:原帖由 xeonpc 于 2007-10-18 23:39 发表
我是新手
烦请老大告诉我这些代码怎么用。呵呵


建議你學 shell script 與一些 shell 變量使用,還有 ip, iptables 命令使用語法,這樣該片段 code 就可以看得懂。

--

离线慧琳迷.
发帖
1929
C币
-60734
威望
391
贡献值
1
银元
-1
铜钱
4306
人人网人气币
0
只看该作者 4楼 发表于: 2010-04-13
这个可以实现我所说的功能么?

离线junbao99.
发帖
2069
C币
-152526
威望
375
贡献值
1
银元
-2
铜钱
4703
人人网人气币
0
只看该作者 5楼 发表于: 2010-04-13
执行完这段代码是这样的

[root@localhost ~]# cat /etc/sysconfig/iptables

# Generated by iptables-save v1.2.11 on Fri Oct 19 01:10:58 2007

*filter

:INPUT ACCEPT [762966:80569415]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [796979:478510599]

-A FORWARD -j ACCEPT

COMMIT

# Completed on Fri Oct 19 01:10:58 2007

# Generated by iptables-save v1.2.11 on Fri Oct 19 01:10:58 2007

*nat

:PREROUTING ACCEPT [19429:1276005]

:POSTROUTING ACCEPT [47:5250]

:OUTPUT ACCEPT [26:3039]

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2-210.*.77.4

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.0

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.0

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.0

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.0

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.0

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.3

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.3

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.3

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.3

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.3

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.4

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.4

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.4

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.4

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.4

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.5

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.5

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.5

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.5

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.5

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.6

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.6

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.6

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.6

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.6

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.7

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.7

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.7

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.7

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.7

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.8

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.8

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.8

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.8

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.8

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.9

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.9

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.9

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.9

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.9

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.10

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.10

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.10

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.10

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.10

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.11

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.11

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.11

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.11

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.11

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.12

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.12

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.12

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.12

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.12

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.13

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.13

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.13

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.13

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.13

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.14

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.14

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.14

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.14

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.14

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.15

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.15

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.15

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.15

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.15

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.16

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.16

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.16

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.16

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.16

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.17

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.17

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.17

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.17

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.17

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.18

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.18

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.18

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.18

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.18

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.19

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.19

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.19

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.19

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.19

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.20

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.20

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.20

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.20

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.20

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.21

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.21

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.21

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.21

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.21

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.22

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.22

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.22

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.22

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.22

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.23

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.23

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.23

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.23

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.23

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.24

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.24

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.24

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.24

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.24

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.25

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.25

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.25

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.25

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.25

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.26

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.26

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.26

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.26

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.26

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.27

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.27

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.27

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.27

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.27

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.28

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.28

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.28

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.28

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.28

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.29

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.29

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.29

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.29

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.29

COMMIT

# Completed on Fri Oct 19 01:10:58 2007

[root@localhost ~]#
复制代码

发帖
1998
C币
-193550
威望
372
贡献值
1
银元
-2
铜钱
4466
人人网人气币
0
只看该作者 6楼 发表于: 2010-04-13


QUOTE:-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2-210.*.77.4


需要在防火墙中把这句去掉

发帖
2032
C币
-235337
威望
403
贡献值
1
银元
-3
铜钱
4695
人人网人气币
0
只看该作者 7楼 发表于: 2010-04-13
LZ你没有说清除30个IP是外网的30个IP地址,还是内网的5个网段每个网段分了30个IP。

离线笨笨猪.
发帖
2239
C币
-234812
威望
406
贡献值
1
银元
-2
铜钱
5086
人人网人气币
0
只看该作者 8楼 发表于: 2010-04-13
30个外网IP。
让内网的 150个用户每5个内网用户NAT到一个外网IP上
比如
10.0.0.2 ->210.*.77.2
10.0.0.3 ->210.*.77.2
10.0.0.4 ->210.*.77.2
10.0.0.5 ->210.*.77.2
10.0.0.6 ->210.*.77.2

10.0.0.7 ->210.*.77.3
10.0.0.8 ->210.*.77.3
10.0.0.9 ->210.*.77.3
10.0.0.10 ->210.*.77.3
10.0.0.11 ->210.*.77.3

发帖
2093
C币
-152295
威望
391
贡献值
1
银元
-1
铜钱
4772
人人网人气币
0
只看该作者 9楼 发表于: 2010-04-13
150个用户同时在线的话 -A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.1

......

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2

-A POSTROUTING -o eth0 -j SNAT --to-source 210.*.77.2
复制代码
允许这样定规则么 ?

这规则的意思是把eth0上的  都out到210.*.77.1
再把eth0上的  都out 到210.*.77.2


允许这样写规则么?
快速回复
限100 字节
如果您在写长篇帖子又不马上发表,建议存为草稿
 
上一个 下一个