Iptables port forwarding

The experiment passed iptables Realize local 22 Port forwarding and remote 3389 Port forwarding , Similarly, from the perspective of hackers, we can only see the springboard machine to hackers IP Of traffic , But you can see two-way traffic on the gangplank , Whether it is local forwarding or remote forwarding , They are all operated on the springboard , This and Port forwarding tool rinetd It's the same , so , Control the springboard , It controls the intranet ～

experiment 1: Forward the local port to the local port

iptables -t nat -A PREROUTING -p tcp --dport 8022 -j REDIRECT --to-port 22 

ssh 192.168.199.247 -p 8022

Observe traffic from the perspective of hackers , Can only be captured from the intranet IP To hackers IP Of traffic

From the perspective of Intranet , You can see two-way traffic

experiment 2: Forward the local port to the remote port

iptables -t nat -A PREROUTING -p tcp --dport 13389 -j DNAT --to-destination 192.168.199.185:3389
# PREROUTING chain ： Process packets before routing （ Do target address conversion ）
#  Go to the springboard machine  13389  Port traffic   forward   To the intranet 3389 port 

iptables -t nat -A POSTROUTING -p tcp -d 192.168.199.185 --dport 3389 -j SNAT --to-source 192.168.199.247
# POSTROUTING chain ： Process packets after routing （ Modify and convert the source address of the data link ）
#  Go to the intranet  3389  Port traffic   Modification source IP It's a springboard machine 

Hackers access the springboard machine 13389 port , You can access the intranet host 3389 port , Achieve remote login .

From the perspective of hackers, we can only see from the springboard to hackers IP Of 13389 Port traffic

From the perspective of the springboard , You can clearly see the request direction ： hackers IP Request the springboard 13389 port , Then the springboard machine accesses the intranet 3389 port , Immediately see the response direction ： Intranet 3389 Port response springboard , Springboard machine 13389 Port responds to hackers IP

Network security has a long way to go , Wash and sleep ～