配置iptables规则，在宿主机上暴露NAT过的虚拟机的内部端口

itpables 规则配置 - 准备工作

[root@ham ~]# vi /etc/sysctl.d/100-iptables.conf [root@ham ~]# sysctl -p /etc/sysctl.d/100-iptables.conf net.ipv4.ip_forward = 1 [root@ham ~]# sysctl -a|grep ip_forward net.ipv4.ip_forward = 1 net.ipv4.ip_forward_update_priority = 1 net.ipv4.ip_forward_use_pmtu = 0 [root@ham ~]# iptables-save > /etc/iptables.0131

此外，如果相关模块没有加载，也可能会导致问题。此时，可通过modprobe命令手动进行加载

DNAT、SNAT、FORWARD规则配置（三种规则缺一不可）

iptables -t nat -A PREROUTING -p tcp --dport 22201 -j DNAT --to-destination 192.168.122.201:22 iptables -t nat -A POSTROUTING -p tcp --dport 22 -d 192.168.122.201 -j SNAT --to 192.168.122.1 iptables -t nat -A PREROUTING -p tcp --dport 22202 -j DNAT --to-destination 192.168.122.202:22 iptables -t nat -A POSTROUTING -p tcp --dport 22 -d 192.168.122.202 -j SNAT --to 192.168.122.1 iptables -t nat -A PREROUTING -p tcp --dport 22203 -j DNAT --to-destination 192.168.122.203:22 iptables -t nat -A POSTROUTING -p tcp --dport 22 -d 192.168.122.203 -j SNAT --to 192.168.122.1 iptables -t nat -A PREROUTING -p tcp --dport 22204 -j DNAT --to-destination 192.168.122.204:22 iptables -t nat -A POSTROUTING -p tcp --dport 22 -d 192.168.122.204 -j SNAT --to 192.168.122.1 iptables -t nat -A PREROUTING -p tcp --dport 22205 -j DNAT --to-destination 192.168.122.205:22 iptables -t nat -A POSTROUTING -p tcp --dport 22 -d 192.168.122.205 -j SNAT --to 192.168.122.1 iptables -t nat -A PREROUTING -p tcp --dport 22206 -j DNAT --to-destination 192.168.122.206:22 iptables -t nat -A POSTROUTING -p tcp --dport 22 -d 192.168.122.206 -j SNAT --to 192.168.122.1 iptables -I FORWARD -m state -d 192.168.122.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT

如果需要还原之前的iptables配置，则可以利用刚刚的备份，通过itpables-restore命令进行还原

iptables-restore < /etc/iptables.0131