流量转发整体方案

一、需求:

硬盘录像机通过服务器转发流量后,在平台上上线

二、技术分析

1、L2TP VPN
2、NAT
3、单网卡多地址
4、Firewall防火墙

三、实现

1、实现逻辑

2、具体操作

A、硬盘录像机IP配置

B、TPlink L2TP VPN配置

C、TPLink 虚拟主机配置

D、服务器防火墙策略
1、内核优化

echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf

sysctl -p

2、vpn部署

systemctl enable ipsec
systemctl restart ipsec
systemctl enable xl2tpd
systemctl restart xl2tpd
systemctl status xl2tpd
systemctl restart xl2tpd
cat /var/log/messages | grep xl2tpd
 cat /var/log/messages | grep "L2TP connection established"
 sudo dhclient -r pppX
sudo dhclient pppX
who | grep ppp
ipsec whack --trafficstatus
ip addr show ppp0
xl2tpd-control disconnect <链接名称>
sudo journalctl -u ipsec
sudo journalctl -u xl2tpd
cat /var/log/ppp.log

3、防火墙配置
a、放行VPN

firewall-cmd --add-port=500/udp —permanent
firewall-cmd --add-port=4500/udp —permanent
firewall-cmd --add-port=1701/udp —permanent
firewall-cmd --add-protocol=esp —permanent
firewall-cmd —reload

b、流量转发

firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -p tcp -d 192.168.0.12 --dport 80 -j DNAT --to-destination 192.168.18.6:80

firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -p tcp -d 192.168.0.12 --dport 8000 -j DNAT --to-destination 192.168.18.6:8000

firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -p tcp -d 192.168.0.12 --dport 554 -j DNAT --to-destination 192.168.18.6:554

firewall-cmd —reload

E、添加上线操作