半途而废的nat穿透(打洞)实验

先配置路由协议
R1
R1#config
R1(config)#int e1/0
R1(config-if)#ip add 40.40.40.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#exit
R1(config)#int e1/1
R1(config-if)#ip add 50.50.50.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#exit
R1(config)#int e1/2
R1(config-if)#ip add 60.60.60.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#exit
R1(config)#int e1/3
R1(config-if)#ip add 70.70.70.1 255.255.255.0
R1(config-if)#no sh
R1(config-if)#exit
//配置路由协议(RIP)
R1(config)#router rip
R1(config-router)#version 2
R1(config-router)#auto-summary
//宣告主网络
R1(config-router)#network 40.40.40.0
R1(config-router)#network 50.50.50.0
R1(config-router)#network 60.60.60.0
R1(config-router)#network 70.70.70.0
R1(config-router)#exit
R1(config)#exit
R1#wr

R2
R2#config
R2(config)#int e1/0
R2(config-if)#ip add 40.40.40.2 255.255.255.0
R2(config-if)#no sh
R2(config-if)#exit
R2(config)#int f0/0
R2(config-if)#ip add 20.20.20.1 255.255.255.0
R2(config-if)#no sh
R2(config-if)#exit
R2(config)#router rip
R2(config-router)#version 2
R2(config-router)#auto-summary
R2(config-router)#network 40.40.40.0
R2(config-router)#network 20.20.20.0
R2(config-router)#exit
R2(config)#exit
R2#wr

R3#config
R3(config)#int e1/0
R3(config-if)#ip add 50.50.50.2 255.255.255.0
R3(config-if)#no sh
R3(config-if)#eix
R3(config-if)#exit
R3(config)#int f0/0
R3(config-if)#ip add 30.30.30.1 255.255.255.0
R3(config-if)#no sh
R3(config-if)#
R3(config-if)#exit
R3(config)#router rip
R3(config-router)#version 2
R3(config-router)#auto-summary
R3(config-router)#network 50.50.50.0
R3(config-router)#network 30.30.30.0
R3(config-router)#exit
R3(config)#exit
R3#wr

R4#config
R4(config)#int e1/0
R4(config-if)#ip add 60.60.60.2 255.255.255.0
R4(config-if)#no sh
R4(config-if)#exit
R4(config)#int
R4(config)#int f0/0
R4(config-if)#ip add 192.168.3.1 255.255.255.0
R4(config-if)#no sh
R4(config-if)#
R4(config-if)#exit
R4(config)#router rip
R4(config-router)#version 2
R4(config-router)#auto-summary
R4(config-router)#network 60.60.60.0
R4(config-router)#network 192.168.3.0
R4(config-router)#exit
R4(config)#exit
R4#wr

R5#config
R5(config)#int e1/0
R5(config-if)#ip add 70.70.70.2 255.255.255.0
R5(config-if)#no sh
R5(config-if)#exit
R5(config-if)#exit
R5(config)#int f0/0
R5(config-if)#ip add 192.168.4.1 255.255.255.0
R5(config-if)#no sh
R5(config-if)#
R5(config-if)#exit
R5(config)#router rip
R5(config-router)#version 2
R5(config-router)#auto-summary
R5(config-router)#network 70.70.70.0
R5(config-router)#network 192.168.4.0
R5(config-router)#exit
R5(config)#exit
R5#wr

配置pc
PC-1> ip 20.20.20.2/24 20.20.20.1
PC-1> save

PC-2> ip 30.30.30.2/24 30.30.30.1
PC-2> save

PC-3> ip 192.168.3.2/24 192.168.3.1
PC-3> save

PC-4> ip 192.168.4.2/24 192.168.4.1
PC-4> save

测试
PC-3 ping PC-1
PC-3> ping 20.20.20.2
20.20.20.2 icmp_seq=1 timeout
84 bytes from 20.20.20.2 icmp_seq=2 ttl=61 time=37.031 ms
84 bytes from 20.20.20.2 icmp_seq=3 ttl=61 time=39.994 ms
//成功
PC-1 ping PC-3
PC-1> ping 192.168.3.2
192.168.3.2 icmp_seq=1 timeout
192.168.3.2 icmp_seq=2 timeout
84 bytes from 192.168.3.2 icmp_seq=3 ttl=61 time=64.416 ms
84 bytes from 192.168.3.2 icmp_seq=4 ttl=61 time=60.514 ms
//成功
其他相互都能ping通的

现在来配置静态nat
配置R4路由器
首先删掉rip中192.168.3.0的网络，这样就外部网络没有路由到该网络了
R4#config
R4(config)#router rip
R4(config-router)#no network 192.168.3.0
R4(config-router)#exit
这时用PC-3 ping 外部网络是不通的
PC-3> ping 192.168.4.2
192.168.4.2 icmp_seq=1 timeout
192.168.4.2 icmp_seq=2 timeout
为R4配置静态nat
在内部本地和内部合法地址之间建立静态地址转换
R4(config)#ip nat inside source static 192.168.3.2 60.60.60.3
在内部和外部端口上启用NAT
R4(config)#int e1/0
R4(config-if)#ip nat outside
R4(config-if)#exit
R4(config)#int f0/0
R4(config-if)#ip nat inside
这时再用PC-3 ping 一下外网
PC-3> ping 192.168.4.2
192.168.4.2 icmp_seq=1 timeout
84 bytes from 192.168.4.2 icmp_seq=2 ttl=61 time=57.843 ms
84 bytes from 192.168.4.2 icmp_seq=3 ttl=61 time=62.901 ms
可以看到通了
R4#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 60.60.60.3:36061 192.168.3.2:36061 192.168.4.2:36061 192.168.4.2:36061
icmp 60.60.60.3:36573 192.168.3.2:36573 192.168.4.2:36573 192.168.4.2:36573

下面将用虚拟机开始nat实验
把pc换成云，这样可以桥接虚拟机网卡

然后去virtualbox添加5张网卡

#2配Service-1 #3配Service-2 #4配Client-1 #5配Client-2 #6配Client-3
设置宿主地址不要与实验内的地址相冲突(否则ping不通)
如

并且不启用dhcp服务器（不打勾如下图）

依照此例配置好所有的网卡
然后创建5台虚拟机（只创建一台，然后复制，里面都有相对应的测试代码）

配置网卡
右键设置->网络 选择“仅主机”模式

依次为5台机器配好对应的网卡

启动虚拟机配置ip和网关
以ubuntu_service1为例
打开命令窗口
查看当前的网卡端口

然后编辑配置文件

20.20.20.1是网关，就是在gns3中Service-1直连着路由器的端口ip

保存
依次为每台虚拟机配上ip和网关

接下来进入gns3中配置主机
以Service-1为例
右键Configure
进入到以下界面

添加对应的网卡，在这里先删掉“以太网 2”，选中它再点击右边的"Delete"键就可以删除
然后下拉列表选中对应的网卡（如果没有，请重启一下gns3，因为刚才添加网卡后没有重启），这里是“***** #2” 网卡

然后点保存

再通过线连接路由器

切记要连正确的端口，这里是f0/0端口（ip:20.20.20.1）
如查在连接过程中出现
Error while sending command ‘bridge add_nio_ethernet b99c767f-29ee-43c2-9344-2308635cfcf4-0 “\Device\NPF_{FFC38220-21C5-4A99-8B05-73ED81A51840}”’: unable to create NIO Ethernet for bridge ‘b99c767f-29ee-43c2-9344-2308635cfcf4-0’: uBridge version 0.9.13 running with WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
Hypervisor TCP control server started (IP 127.0.0.1 port 64806).
UDP tunnel connecting from local port 10045 to IPv4 addresss 127.0.0.1 on port 10044
nio_ethernet_open: unable to open device ‘\Device\NPF_{FFC38220-21C5-4A99-8B05-73ED81A51840}’: Error opening adapter: ϵͳ�Ҳ���ָ�����豸�� (20)
类似错误码
是因为没有权限，重启电脑试一下看，如果还不行就卸载原来的WinPcap，重新以管理员权限安装

依次配好5台主机

用Client-1 ping一下Service-1 （两台虚拟机都要打开才能ping得通）

成功
用Client-2 ping Service-1是ping不通的，因为没有为它配置NAT静态地址转换

那就为它配上一条
R4#config
R4(config)#ip nat inside source static 192.168.3.3 60.60.60.4
R4(config)#exit

现在用代码来测试udp了（之前写好的）
在Service-1中运行代码（socket绑定20.20.20.2:8765)

在Client-1中运行并发送信息

在service-1收到信息

查看一下路由器的转换

端口是：51377
再发一条，端口号还是51377
用Service-1回一条信息
Client-1收到信息为

端口号是Service-1绑定的端口号8765
分别重启两个程序来一次

端口号变了,为46655
开启Client-2也往Service-1(20.20.20.2:8765)发送信息 能通，端口为57765

Service-2 send to Client-1（60.60.60.3:46655） 能通
为R5路由器也配置静态NAT
Client-3 send to Client-1(60.60.60.3:46655) 能通
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:53790 192.168.4.2:53790 60.60.60.3:46655 60.60.60.3:46655

Client-1 send to Client-3(70.70.70.3:53790) 能通
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:46655 192.168.3.2:46655 70.70.70.3:53790 70.70.70.3:53790

动态NAT
删除静态nat
R4(config)#no ip nat inside source static 192.168.3.2 60.60.60.3
R4(config)#no ip nat inside source static 192.168.3.3 60.60.60.4
定义内部网络中允许访问外部的访问控制列表
R4(config)#access-list 1 permit 192.168.3.0 0.0.0.255
定义合法IP地址池
R4(config)#ip nat pool test0 60.60.60.3 60.60.60.10 prefix-length 24
指定网络地址转换映射
R4(config)#ip nat inside source list 1 pool test0
在内部和外部端口上启用NAT（上面已配过）

R5#config
R5(config)#no ip nat inside source static 192.168.4.2 70.70.70.3
R5(config)#access-list 1 permit 192.168.4.0 0.0.0.255
R5(config)#ip nat pool test0 70.70.70.3 70.70.70.10 prefix-length 24
R5(config)#ip nat inside source list 1 pool test0

Client-1 send to Service-1 20.20.20.2:8765
Service-1 receive from 60.60.60.3:60348
查看路由器
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:60348 192.168.3.2:60348 20.20.20.2:8765 20.20.20.2:8765

Service-1 send to Client-1 60.60.60.3:60348
Client-1 receive from 20.20.20.2:8765

Service-2 send to Client-1 60.60.60.3:60348
Client-1 receive from 30.30.30.2:8765

Client-3 send to Client-1 60.60.60.3:60348
Client-1 receive from 70.70.70.3:39262

Client-1 send to Client-3 70.70.70.3:39262
Client-3 receive from 60.60.60.3:60348

Client-3 send to Service-1 20.20.20.2:8765
Service-1 receive from 70.70.70.3:39262

Service-1 send to Client-3 70.70.70.3:39262
Client-3 receive from 20.20.20.2:8765

Client-2 sent to Service-1 20.20.20.2:8765
Service-1 receive from 60.60.60.4:41559

Client-3 send to Client-2 60.60.60.4:41559
Client-2 receive from 70.70.70.3:39262

Service-2 send to Client-2 60.60.60.4:41559
Client-2 receive from 30.30.30.2:8765

Client-1 send to Client-2 60.60.60.4:41559 不通
Client-2 send to Client-1 60.60.60.3:60348 不通

Client-1 send to Client-2 192.168.3.3:41559
Client-2 receive from 192.168.3.2:60348

上面的例子访问外网时nat只改变ip地址不改变端口
以上所有的Client端都没有绑定端口，只有服务端绑定了端口，现在让所有Client端也绑上自己的本地端口6543
Client-1 send to Service-1 20.20.20.2:8765
Service-1 receive from 60.60.60.4:6543
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.4:6543 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765

Client-2 send to Service-1 20.20.20.2:8765
Service-1 receive from 60.60.60.5:6543

Client-1 send to Client-2 60.60.60.5:6543 no ok
Client-1 send to Client-2 192.168.3.3:6543 ok
Client-2 send to Client-1 192.168.3.2:6543 ok

以上的静态nat和动态nat是不是很容易穿透？
之前定义了多个合法的地址池，现在只定义一个看看
R4#config
R4(config)#ip nat pool test0 60.60.60.3 60.60.60.3 prefix-length 24

R5#config
R5(config)#ip nat pool test0 70.70.70.3 70.70.70.3 prefix-length 24

Client-1 send to Service-1 20.20.20.2:8765
Service-1 receive from 60.60.60.3:6543
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765

Client-2 send to Service-1 20.20.20.2:8765 no ok

PAT配置
删除动态nat
R4(config)#no access-list 1 permit 192.168.3.0 0.0.0.255
R4(config)#no ip nat pool test0 60.60.60.3 60.60.60.3 prefix-length 24
R4(config)#no ip nat inside source list 1 pool test0

R4#config
定义内部网络中允许访问外部的访问控制列表
R4(config)#access-list 1 permit 192.168.3.0 0.0.0.255
定义合法IP地址池
R4(config)#ip nat pool onlyone 60.60.60.3 60.60.60.3 netmask 255.255.255.248
指定网络地址转换映射
R4(config)#ip nat inside source list 1 pool onlyone overload

R5#config
R5(config)#access-list 1 permit 192.168.4.0 0.0.0.255
R5(config)#ip nat pool onlyone 70.70.70.3 70.70.70.3 netmask 255.255.255.248
R5(config)#ip nat inside source list 1 pool onlyone overload

Client-1 send to Service-1
Service-1 receive from 60.60.60.3:6543
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765

Service-1 send to Client-1 60.60.60.3:6543 ok
Service-2 send to Client-1 60.60.60.3:6543 no ok
Client-1 send to Service-2
Service-2 receive from 60.60.60.3:6543
这时就可以了
Service-2 send to Client-1 60.60.60.3:6543 ok

Client-2 send to Service-1
Service-1 receive from 60.60.60.3:6543
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.3:6543 20.20.20.2:8765 20.20.20.2:8765

Service-1 send to 60.60.60.3:6543 Client-2 能收到，Client-1不能收到
Client-1 send to Service-1
Service-1 receive from 60.60.60.3:1024 //端口号变了
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:1024 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765

Service-1 send to 60.60.60.3:1024 Client-1能收到
Service-1 send to 60.60.60.3:6543 Client-2 收不到

Client-2 send to Service-1
Service-1 receive from 60.60.60.3:6543
这时再
Service-1 send to 60.60.60.3:6543 Client-2 能收到
Service-1 send to 60.60.60.3:1024 Cleint-1 收不到
内网两个客户端连同一个服务端，同时只有一个是活的

Client-1 send to 192.168.3.3:6543 ok
Client-2 send to 192.168.3.2:6543 ok

重启再来
Client-2 send to Service-1
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.3:6543 20.20.20.2:8765 20.20.20.2:8765

Client-3 send to Service-1
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:6543 192.168.4.2:6543 20.20.20.2:8765 20.20.20.2:876

接下来想让Client-2与Client-3通信
首先让Cleint-2 send to Client-3
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.3:6543 70.70.70.3:6543 70.70.70.3:6543
端口还是6543，这样发过去，Client-3是收不到的，因为Client-3还没有Client-2的映射
然后让Client-3 send to Client-2 是能通的，因为Client-2的路由器已经有了Client-3的映射了

让Client-1 send to Service-1
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:1028 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765
端口变成了1028 而不是6543
再让Client-1 send to Client-3
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:1029 192.168.3.2:6543 70.70.70.3:6543 70.70.70.3:6543
端口变成了1029
这让Client-3怎么发信息给Client-2呢？

测试2
Client-3 send to Service-1
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:6543 192.168.4.2:6543 20.20.20.2:8765 20.20.20.2:8765

Client-1 send to Service-1
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765

Client-3 send to Client-1
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:6543 192.168.4.2:6543 20.20.20.2:8765 20.20.20.2:8765
udp 70.70.70.3:6543 192.168.4.2:6543 60.60.60.3:6543 60.60.60.3:6543
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765
udp 60.60.60.3:6543 192.168.3.2:6543 70.70.70.3:6543 70.70.70.3:6543

Client-2 send to Service-1
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:6543 192.168.3.2:6543 20.20.20.2:8765 20.20.20.2:8765
udp 60.60.60.3:6543 192.168.3.2:6543 70.70.70.3:6543 70.70.70.3:6543
udp 60.60.60.3:1030 192.168.3.3:6543 20.20.20.2:8765 20.20.20.2:8765
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:6543 192.168.4.2:6543 20.20.20.2:8765 20.20.20.2:8765
udp 70.70.70.3:6543 192.168.4.2:6543 60.60.60.3:1030 60.60.60.3:1030
udp 70.70.70.3:6543 192.168.4.2:6543 60.60.60.3:6543 60.60.60.3:6543

Client-3 send to Client-2
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:6543 192.168.4.2:6543 60.60.60.3:1030 60.60.60.3:1030

Client-2 send to Client-3
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:1031 192.168.3.3:6543 70.70.70.3:6543 70.70.70.3:6543
端口号变成了1031，而Client-3 是按1030发过来的，所以通不了

测试3 Client端不绑定端口
Client-1 send to Service-1
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:52021 192.168.3.2:52021 20.20.20.2:8765 20.20.20.2:8765

Client-3 send to Service-1
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:45148 192.168.4.2:45148 20.20.20.2:8765 20.20.20.2:8765

Client-1 send to Client-3
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:52021 192.168.3.2:52021 20.20.20.2:8765 20.20.20.2:8765
udp 60.60.60.3:52021 192.168.3.2:52021 70.70.70.3:45148 70.70.70.3:45148

Client-3 send to Client-1 ok
R5#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 70.70.70.3:45148 192.168.4.2:45148 20.20.20.2:8765 20.20.20.2:8765
udp 70.70.70.3:45148 192.168.4.2:45148 60.60.60.3:52021 60.60.60.3:52021

Client-2 send to Service-1
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:52021 192.168.3.2:52021 20.20.20.2:8765 20.20.20.2:8765
udp 60.60.60.3:52021 192.168.3.2:52021 70.70.70.3:45148 70.70.70.3:45148
udp 60.60.60.3:60672 192.168.3.3:60672 20.20.20.2:8765 20.20.20.2:8765

Client-2 send to Service-1
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:52021 192.168.3.2:52021 20.20.20.2:8765 20.20.20.2:8765
udp 60.60.60.3:52021 192.168.3.2:52021 70.70.70.3:45148 70.70.70.3:45148
udp 60.60.60.3:60672 192.168.3.3:60672 20.20.20.2:8765 20.20.20.2:8765

Client-2 send to Client-3
R4#show ip nat trans
Pro Inside global Inside local Outside local Outside global
udp 60.60.60.3:52021 192.168.3.2:52021 70.70.70.3:45148 70.70.70.3:45148
udp 60.60.60.3:60672 192.168.3.3:60672 20.20.20.2:8765 20.20.20.2:8765
udp 60.60.60.3:60672 192.168.3.3:60672 70.70.70.3:45148 70.70.70.3:45148
端口还是60672

Client-3 send to Client-2 ok