Имею
1
роутер с ip 192.168.1.1
2 ноутбук
Ubuntu c ip 192.168.1.183
3 на ноутбуке с ubuntu есть виртуальная ос
centos с ip 192.168.1.153
Что не нужно: не нужен доступ из из интернета на роутер.
Что нужно,
1. входящие пакеты из интернета на роутер, перенаправить на адрес 192.168.1.153 (порты 22 и 1194)
2. входящие пакеты из интернета на роутер, перенаправить на адрес 192.168.1.183 (порт 51413)
Я немного в недоумении, пытался подключиться на порт 1194 и 22 из интернета, соединение отваливалось по таймауту, в логах попыток подключения нет.
Теперь iptables правила. На роутре (прошивка openwrt)
узел 192.168.1.1# Generated by iptables-save v1.4.21 on Mon Feb 27 14:38:42 2017
*nat
:PREROUTING ACCEPT [1182:118345]
:INPUT ACCEPT [241:22118]
:OUTPUT ACCEPT [426:27768]
:POSTROUTING ACCEPT [2:392]
:delegate_postrouting - [0:0]
:delegate_prerouting - [0:0]
:postrouting_lan_rule - [0:0]
:postrouting_rule - [0:0]
:postrouting_wan_rule - [0:0]
:prerouting_lan_rule - [0:0]
:prerouting_rule - [0:0]
:prerouting_wan_rule - [0:0]
:zone_lan_postrouting - [0:0]
:zone_lan_prerouting - [0:0]
:zone_wan_postrouting - [0:0]
:zone_wan_prerouting - [0:0]
-A PREROUTING -j delegate_prerouting
-A POSTROUTING -j delegate_postrouting
-A delegate_postrouting -m comment --comment "user chain for postrouting" -j postrouting_rule
-A delegate_postrouting -o br-lan -j zone_lan_postrouting
-A delegate_postrouting -o pppoe-PPPOE -j zone_wan_postrouting
-A delegate_prerouting -m comment --comment "user chain for prerouting" -j prerouting_rule
-A delegate_prerouting -i br-lan -j zone_lan_prerouting
-A delegate_prerouting -i pppoe-PPPOE -j zone_wan_prerouting
-A zone_lan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_lan_rule
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.153/32 -p tcp -m tcp --dport 22 -m comment --comment "SSH (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.183/32 -p tcp -m tcp --dport 51413 -m comment --comment "torrent (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.183/32 -p udp -m udp --dport 51413 -m comment --comment "torrent (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_postrouting -s 192.168.1.0/24 -d 192.168.1.153/32 -p udp -m udp --dport 1194 -m comment --comment "openvpn (reflection)" -j SNAT --to-source 192.168.1.1
-A zone_lan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_lan_rule
-A zone_lan_prerouting -s 192.168.1.0/24 -d 100.65.48.86/32 -p tcp -m tcp --dport 22 -m comment --comment "SSH (reflection)" -j DNAT --to-destination 192.168.1.153:22
-A zone_lan_prerouting -s 192.168.1.0/24 -d 100.65.48.86/32 -p tcp -m tcp --dport 51413 -m comment --comment "torrent (reflection)" -j DNAT --to-destination 192.168.1.183:51413
-A zone_lan_prerouting -s 192.168.1.0/24 -d 100.65.48.86/32 -p udp -m udp --dport 51413 -m comment --comment "torrent (reflection)" -j DNAT --to-destination 192.168.1.183:51413
-A zone_lan_prerouting -s 192.168.1.0/24 -d 100.65.48.86/32 -p udp -m udp --dport 1194 -m comment --comment "openvpn (reflection)" -j DNAT --to-destination 192.168.1.153:1194
-A zone_wan_postrouting -m comment --comment "user chain for postrouting" -j postrouting_wan_rule
-A zone_wan_postrouting -j MASQUERADE
-A zone_wan_prerouting -m comment --comment "user chain for prerouting" -j prerouting_wan_rule
-A zone_wan_prerouting -p tcp -m tcp --dport 22 -m comment --comment SSH -j DNAT --to-destination 192.168.1.153:22
-A zone_wan_prerouting -p tcp -m tcp --dport 51413 -m comment --comment torrent -j DNAT --to-destination 192.168.1.183:51413
-A zone_wan_prerouting -p udp -m udp --dport 51413 -m comment --comment torrent -j DNAT --to-destination 192.168.1.183:51413
-A zone_wan_prerouting -p udp -m udp --dport 1194 -m comment --comment openvpn -j DNAT --to-destination 192.168.1.153:1194
COMMIT
# Completed on Mon Feb 27 14:38:42 2017
# Generated by iptables-save v1.4.21 on Mon Feb 27 14:38:42 2017
*raw
:PREROUTING ACCEPT [390452:503656343]
:OUTPUT ACCEPT [932:190466]
:delegate_notrack - [0:0]
-A PREROUTING -j delegate_notrack
COMMIT
# Completed on Mon Feb 27 14:38:42 2017
# Generated by iptables-save v1.4.21 on Mon Feb 27 14:38:42 2017
*mangle
:PREROUTING ACCEPT [390456:503656551]
:INPUT ACCEPT [946:182049]
:FORWARD ACCEPT [389483:503466743]
:OUTPUT ACCEPT [932:190466]
:POSTROUTING ACCEPT [390415:503657209]
:fwmark - [0:0]
:mssfix - [0:0]
-A PREROUTING -j fwmark
-A FORWARD -j mssfix
-A mssfix -o pppoe-PPPOE -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --comment "wan (mtu_fix)" -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Mon Feb 27 14:38:42 2017
# Generated by iptables-save v1.4.21 on Mon Feb 27 14:38:42 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:delegate_forward - [0:0]
:delegate_input - [0:0]
:delegate_output - [0:0]
:forwarding_lan_rule - [0:0]
:forwarding_rule - [0:0]
:forwarding_wan_rule - [0:0]
:input_lan_rule - [0:0]
:input_rule - [0:0]
:input_wan_rule - [0:0]
:output_lan_rule - [0:0]
:output_rule - [0:0]
:output_wan_rule - [0:0]
:reject - [0:0]
:syn_flood - [0:0]
:zone_lan_dest_ACCEPT - [0:0]
:zone_lan_forward - [0:0]
:zone_lan_input - [0:0]
:zone_lan_output - [0:0]
:zone_lan_src_ACCEPT - [0:0]
:zone_wan_dest_ACCEPT - [0:0]
:zone_wan_forward - [0:0]
:zone_wan_input - [0:0]
:zone_wan_output - [0:0]
:zone_wan_src_ACCEPT - [0:0]
-A INPUT -j delegate_input
-A FORWARD -j delegate_forward
-A OUTPUT -j delegate_output
-A delegate_forward -m comment --comment "user chain for forwarding" -j forwarding_rule
-A delegate_forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_forward -i br-lan -j zone_lan_forward
-A delegate_forward -i pppoe-PPPOE -j zone_wan_forward
-A delegate_forward -j reject
-A delegate_input -i lo -j ACCEPT
-A delegate_input -m comment --comment "user chain for input" -j input_rule
-A delegate_input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_input -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A delegate_input -i br-lan -j zone_lan_input
-A delegate_input -i pppoe-PPPOE -j zone_wan_input
-A delegate_output -o lo -j ACCEPT
-A delegate_output -m comment --comment "user chain for output" -j output_rule
-A delegate_output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A delegate_output -o br-lan -j zone_lan_output
-A delegate_output -o pppoe-PPPOE -j zone_wan_output
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan_dest_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_forward -m comment --comment "user chain for forwarding" -j forwarding_lan_rule
-A zone_lan_forward -m comment --comment "forwarding lan -> wan" -j zone_wan_dest_ACCEPT
-A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_lan_forward -j zone_lan_dest_ACCEPT
-A zone_lan_input -m comment --comment "user chain for input" -j input_lan_rule
-A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_lan_input -j zone_lan_src_ACCEPT
-A zone_lan_output -m comment --comment "user chain for output" -j output_lan_rule
-A zone_lan_output -j zone_lan_dest_ACCEPT
-A zone_lan_src_ACCEPT -i br-lan -j ACCEPT
-A zone_wan_dest_ACCEPT -o pppoe-PPPOE -j ACCEPT
-A zone_wan_forward -m comment --comment "user chain for forwarding" -j forwarding_wan_rule
-A zone_wan_forward -d 192.168.1.183/32 -p tcp -m tcp --sport 51413 --dport 51413 -m comment --comment torrent -j zone_lan_dest_ACCEPT
-A zone_wan_forward -d 192.168.1.183/32 -p udp -m udp --sport 51413 --dport 51413 -m comment --comment torrent -j zone_lan_dest_ACCEPT
-A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "Accept port forwards" -j ACCEPT
-A zone_wan_forward -j zone_wan_dest_ACCEPT
-A zone_wan_input -m comment --comment "user chain for input" -j input_wan_rule
-A zone_wan_input -p udp -m udp --dport 68 -m comment --comment Allow-DHCP-Renew -j ACCEPT
-A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment Allow-Ping -j ACCEPT
-A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "Accept port redirections" -j ACCEPT
-A zone_wan_input -j zone_wan_src_ACCEPT
-A zone_wan_output -m comment --comment "user chain for output" -j output_wan_rule
-A zone_wan_output -j zone_wan_dest_ACCEPT
-A zone_wan_src_ACCEPT -i pppoe-PPPOE -j ACCEPT
COMMIT
# Completed on Mon Feb 27 14:38:42 2017
узел 192.168.1.153# Generated by iptables-save v1.4.21 on Mon Feb 27 17:41:27 2017
*nat
:PREROUTING ACCEPT [133:9177]
:INPUT ACCEPT [5:228]
:OUTPUT ACCEPT [126:9219]
:POSTROUTING ACCEPT [126:9219]
-A POSTROUTING -s 10.8.0.0/24 -o enp0s3 -j MASQUERADE
COMMIT
# Completed on Mon Feb 27 17:41:27 2017
# Generated by iptables-save v1.4.21 on Mon Feb 27 17:41:27 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [1154:187616]
:OUTPUT ACCEPT [1738:332662]
:f2b-sshd - [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j f2b-sshd
-A INPUT -p tcp -m tcp --dport 22 -j f2b-sshd
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A f2b-sshd -j RETURN
-A f2b-sshd -j RETURN
COMMIT
# Completed on Mon Feb 27 17:41:27 2017
узел 192.168.1.153# Generated by iptables-save v1.6.0 on Mon Feb 27 18:42:34 2017
*filter
:INPUT ACCEPT [505069:722588037]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [75762:5698033]
COMMIT
# Completed on Mon Feb 27 18:42:34 2017
Мой текущий, внешний IP 92.43.2.214 (динамический) Просканируйте пожалуйста nmap 92.43.2.214 -Pn
Суть в том, что ко мне на 22 порт ломились недавно, но я сам не смог подключиться. А 2ip говорил, что порты закрыты. Что то двоякая ситуация, не пойму кто прав, а кто нет
Заметил, что на одном сайте определяется айпи как 92.43.1.214, а на другом 92.43.2.214 Интересно, очень интересно. Пойду у провайдера узнаю, что не так с этим делом