Destination NAT with netfilter (DNAT)

Destination NAT with netfilter is commonly used to publish a service from an internal RFC 1918 network to a publicly accessible IP. To enable DNAT, at least one iptables command is required. The connection tracking mechanism of netfilter will ensure that subsequent packets exchanged in either direction (which can be identified as part of the existing DNAT connection) are also transformed.

用netfilter架构的DNAT经常被用来将内网服务对外网开放。为了使用DNAT，你必须最少运行一个iptables命令。netfilter的连接跟踪装置可以确保数据包在任一个方向上被交换（连接跟踪装置被认为是DNAT存在的链接）并被转换。

In a devilishly subtle difference, netfilter DNAT does not cause the kernel to answer ARP requests for the NAT IP, where iproute2 NAT automatically begins answering ARP requests for the NAT IP.

有一点细微的差别，netfilter DNAT 不引起内核应答对于NAT IP的ARP请求，iproute2 NAT 自动应答对于NAT IP的ARP请求。

Example 5.5. Using DNAT for all protocols (and ports) on one IP

例：5.5.在一个IP地址对所有协议（端口）使用DNAT

[root@real-server]# iptables -t nat -A PREROUTING -d 10.10.20.99 -j DNAT --to-destination 10.10.14.2

In this example, all packets arriving on the router with a destination of 10.10.20.99 will depart from the router with a destination of 10.10.14.2.

在这个例子中，所有目标地址是10.10.20.99的数据包将改为目标地址为10.10.14.2离开路由。

 

 

 

 

Example 5.6. Using DNAT for a single port

例5.6.对单一端口使用DNAT

[root@real-server]# iptables -t nat -A PREROUTING -p tcp -d 10.10.20.99 --dport 80 -j DNAT --to-destination 10.10.14.2

 

 

 

 

 

Full network address translation, as performed with iproute2 can be simulated with both netfilter SNAT and DNAT, with the potential benefit (and attendent resource consumption) of connection tracking.

完全的网络地址转换，就像iproute2表现的一样，能够用netfilter SNAT 和 DNAT 来伪装，产生潜在的跟踪链接带来的利益（也会产生随之而来的资源消耗）。

Example 5.7. Simulating full NAT with SNAT and DNAT

例5.7.用SNAT和DNAT来模拟完全NAT

[root@real-server]# iptables -t nat -A PREROUTING -d 205.254.211.17 -j DNAT --to-destination 192.168.100.17 [root@real-server]# iptables -t nat -A POSTROUTING -s 192.168.100.17 -j SNAT --to-destination 205.254.211.17