iptables做nat网络地址转换。

0. 权威文档

http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html

e文好的直接跳过本文。

1. Source NAT

在POSTROUTING链里面定义，用-j SNAT，--to-source 省略成--to，ip ，ip段，地址段

## Change source addresses to 1.2.3.4.

# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4

## Change source addresses to 1.2.3.4, 1.2.3.5 or 1.2.3.6

# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4-1.2.3.6

## Change source addresses to 1.2.3.4, ports 1-1023

# iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 1.2.3.4:1-1023

Masquerading

其实是snat中的一种特殊情况，用在来源动态的地址。而且不能指定source address，只能指定来源端口(interface).

But more importantly, if the link goes down, the connections (which are now lost anyway) are forgotten, meaning fewer glitches when connection comes back up with a new IP address.

## Masquerade everything out ppp0.

# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

2. Destination NAT

定义在PREROUTING链。用-j DNAT，--to-destination指定ip，ip段，端口段。

## Change destination addresses to 5.6.7.8

# iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 5.6.7.8

## Change destination addresses to 5.6.7.8, 5.6.7.9 or 5.6.7.10.

# iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 5.6.7.8-5.6.7.10

## Change destination addresses of web traffic to 5.6.7.8, port 8080.

# iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth0 -j DNAT --to 5.6.7.8:8080

Redirection

Redirection是dnat一种特殊情况，将数据库转发到相同interface的另一个端口。

## Send incoming port-80 web traffic to our squid (transparent) proxy

# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \

        -j REDIRECT --to-port 3128

squid做透明代理的时候就用这条规则。