²{¦b¡M§Ú̪¾¹D¦p¦ó¥h¬D¿ï¨º¨Ç§ÚÌn mangle ªº«Ê¥]¡C¬°¤Fn§¹µ½§Ú̪º³W«h¡M§ÚÌ»Ýn·Ç½TµL» ªº§i¶D®Ö¤ß¡M¤°»ò¤ ¬O§ÚÌn¹ï«Ê¥]°µªº¡C
±z·Qn°µ Source NAT¡M¬On¥h±N³s½uªº¨Ó·½¦a§}´«¦¨§Oªº¤°»òªº¡C³o´Nn¦b¥¦³Ì«án°e¥X¥h¤§«e¡M©ó POSTROUTING Ã줤§¹¦¨¤F¡Q³o¬O¤@Ó«D±`«nªº²Ó¸`¡M¦]¬°¥¦·N¨ýµÛ©Ò¦³¦b Linux ¥D¾÷¥»¨¤Wªº¨ä¥¦ªF¦è (routing, packet filtering) ³£¥u¬Ý¨£¨ºÓÁÙ¨S§ïÅܪº«Ê¥]¡C¦P®É¡M³o¤]´N¬O»¡¡M`-o' (¶Ç¥X¬É±) ¿ï¶µ¥i¥H¬£¤W¥Î³õ¤F¡C
Source NAT ¬O¥Î `-j SNAT' ¨Ó«ü©wªº¡M¦P®É¡M `--to source' «h«ü©w¤@Ó IP ¦a§}¡N©Î¤@¬q IP ¦a§}¡N¥H¤Î¤@Ó¥i°t¿ïªº°ð¤f©Î¤@¬qȰ쪺°ð¤f(¶È¾A¥Î©ó UDP ©M TCP ¨ó©w)¡C
## Change source addresses to 1.2.3.4.
# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4
## Change source addresses to 1.2.3.4, 1.2.3.5 or 1.2.3.6
# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4-1.2.3.6
## Change source addresses to 1.2.3.4, ports 1-1023
# iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 1.2.3.4:1-1023
¦³¤@Ó Source NAT ¤§¯S¨Ò¡M¥s°µ«Ê¥]°°¸Ë¡R¥¦¥u¥Î©ó°ÊºA¤À°tªº IP ¦a§}¡M¨Ò¦p¼Ð·Çªº¼·±µ(¦pªG¥ÎÀRºA IP ¦a§}¡M«h¨Ï¥Î«ez¤§ SNAT)¡C
±zµL»Ý©ú½T¦a±N masquerading ©ñ¶i¨Ó·½¦a§}¨º¸Ì¥h¡R¥¦±N·|¨Ï¥Î«Ê¥]¶Ç¥X¬É±§@¬°¨Ó·½¦a§}¡C¦ý§ó«nªº¬O¡M¦pªG¸Ó³s±µ(link)Â_±¼ªº¸Ü¡M¨º»ò³s½u (connections¡MµL¥iÁקKªº±N¥¢±¼) ¤]·|³Q§Ñ±¼¡M·í³s½u¥Î·sªº IP ¦a§}¦^¨Óªº®ÉÔ´N·|¦³°ÝÃD¤F¡C
## Masquerade everything out ppp0.
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
¤@¥¹«Ê¥]¶i¤J¡M·|¥Ñ PREROUTING Ã짹¦¨³B²z¡Q¤]´N¬O»¡¡M°£¤F¸Ó¥D¾÷¦Û¤vªº¨ä¥¦ªF¦è(½Ñ¦p¡R¸ô¥Ñ¡N«Ê¥]¹LÂo) ³£±N«Ê¥]¬Ý¦¨n°e¨ì `¯u¥¿' ¥Øªº¦a¡C¥t¥ ¡M¨ºÓ `-i' (¶Ç¤J¬É±) ¿ï¶µ¤]¥i¥H¦b³o¸Ì¨Ï¥Î¡C
»Ýnק糧¾÷²£¥Íªº«Ê¥]¤§¥Øªº¦aªº¸Ü¡M¨º»ò OUTPUT Ãì´N¥i¥H¥Î¤W¤F¡M¤£¹L³o¨Ã¤£±`¸I¨ì¡C
Destination NAT ¥²¶·¥H `-j DNAT' ¨Ó«ü©w¨Ï¥Î¡M¦P®É¥Î `--to destination' ¿ï¶µ«ü©w¤@Ó IP ¦a§}¡N©Î¤@¬q IP ¦a§}¡M¥H¤Î¥i¥H°t¿ï¤@Ó°ð¤f©Î¤@¬q°ð¤fÈ°ì(¥u¯à¥Î©ó UDP ©M TCP ¨ó©w¤W±)¡C
## Change destination addresses to 5.6.7.8
# iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 5.6.7.8
## Change destination addresses to 5.6.7.8, 5.6.7.9 or 5.6.7.10.
# iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 5.6.7.8-5.6.7.10
## Change destination addresses of web traffic to 5.6.7.8, port 8080.
# iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth1 \
-j DNAT --to 5.6.7.8:8080
## Redirect local packets to 1.2.3.4 to loopback.
# iptables -t nat -A OUTPUT -d 1.2.3.4 -j DNAT --to 127.0.0.1
¦b Destination NAT ¦³¤@Ó¯S§Oªº±¡§Î¡R¥¦¬O¤@Ó²³æªº«K§Q¡M§¹¥þµ¥¦P©óµ¹¶Ç¤J¬É±¦a§}°µ DNAT ¤@¼Ë¡C
## Send incoming port-80 web traffic to our squid (transparent) proxy
# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
-j REDIRECT --to-port 3128
ÁÙ¦³³\¦h NAT ¤W±ªº¸Ñ¨M¤è®×¬O¤j¦h¼Æ¤HµL»Ý¥Î¨ìªº¡C³o¸Ì¤£§«©M¨º¨Ç¦³¿³½ìªºªB¤Í±´°Q¤@¤U¡R
¦pªG±z¤w¸g«ü©w¤F¤@¬q IP ¦a§}¡M ¦Ó IP ¦a§}ªº¨Ï¥Î¿ï¾Ü¬O°ò©ó¾÷¾¹©Òª¾³s½u¥Ø«e³Ì¤Ö¨Ï¥Î¤§ IP¡C¥¦¥i¥H´£¨Ñ³Ìì©lªº¥¿Åt¸ü(load-balancing)¡C
±z¥i¥H¨Ï¥Î `-j ACCEPT' ¥Ø¼Ð¨ÓÅý¤@Ó³s½u³q¹L¡M¦Ó¶¹L NAT ªº³B²z¡C
¹w³]ªº¦æ¬°¬O¦b¨Ï¥ÎªÌ¨î©wªº³W«h¨î¤º¡MºÉ¥i¯à¤Öªº§ïÅܳs½u¡C´«¦Ó¨¥¤§¡M«D¤£±o¤w¤£n«¬M¹ï(remap)°ð¤f¡C
¦pªG¨ä¥¦³s½u¤w¸g³Q¬M¹ï¨ì·sªº³s½u¡M´Nºâ¹ï©ó¤@ÓµL»Ý NAT ªº³s½u¨Ó»¡¡M¨Ó·½°ð¤fªºÂà´«¦³®É©Î¬O¥²¶·µ´¹ï¦s¦bªº¡CÅý§ÚÌ°²³]¤@Ó«Ê¥]°°¸Ëªº±¡§Î¡M³o¤w¸g«D±`´¶¹M¤F¡R
·í³oÓµ´¹ï¨Ó·½¬M¹ï¦s¦b¤§®É¡M°ð¤f³Q©î¤À¬°¤TÓµ¥¯Å¡R
¥ô¦ó¤@Ó°ð¤f³£¤£·|³Qµ´¹ï¬M¹ï¨ì¤£¦Pªºµ¥¯Å¥h¡C
¦pªG¨S¦³¿ìªk¦p¥Î¤án¨D¨º¼Ë¿W¤@µL¤G¦a¬M¹ï³s½u¡M¨º»ò³s½u´N·|³Q¾×±¼¡C·í¤@Ó«Ê¥]¤£¯à°÷¬É©w¬°¥ô¦ó³s½uªº®ÉÔ¡Mµ²ªG¤]¤@¼Ë¡M¦]¬°¥¦Ì¥iºâ¬O·î§Îªº¡M©ÎªÌ¬O¸Ó¾÷¾¹°O¾ÐÅé¯Ó¥ú¤F¡M½Ñ¦p¦¹Ãþ¡C
±z¥i¥H³]©w NAT ³W«h¦b¦P¤@Ó½d³ò¤§¤W¬M¹ï«Ê¥]¡QNAT µ{¦¡¨¬¥HÁo©úªº¥hÁקK¬Û½Ä¡C¤ñ¤è»¡¡M¥Î¨â±ø³W«h±N 192.168.1.1 ©M 192.168.1.2 ³o¨âÓ¨Ó·½¦a§}¤À§O¬M¹ï¨ì 1.2.3.4¡M¬O§¹¥þ¥i¦æªº¡C
¦A¨Ó¡M±z¥i¥H¬M¹ï¨ì¯u¹êªº¡N¤w¥Îªº IP ¦a§}¡M¥un³o¨Ç¦a§}³q¹L³oÓ¬M¹ï¥D¾÷´N¦æ¡C©Ò¥H¡M¦pªG±zÀò±o¤@Óºô¸ô(1.2.3.0/24)¡M¦ý¦³¤@Ó¤º³¡ºô¸ô¨Ï¥Î³o¨Ç¦a§}¡M¦Ó¥t¤@ӨϥΨp¦³¦a§} 192.168.1.0/24 ¡M±z´N¥i¥H NAT ¨º¨Ç 192.168.1.0/24 ªº¨Ó·½¦a§}¨ì 1.2.3.0 ºô¸ô¤§¤W¡M¦ÓµL»Ý¾á¤ß¬Û½Ä¡R
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 \
-j SNAT --to 1.2.3.0/24
³o¦P¼Ë¾A¥Î©ó¨º¨Ç NAT ¥D¾÷¦Û¤v¨Ï¥Îªº¦a§}¡R³o¨ä¹ê´N¬O«Ê¥]°°¸Ë¦p¦ó¤u§@ªº¤F(¤À¨É°°¸Ë«Ê¥]¦a§}©M¨Ó¦Û¥D¾÷¥»¨«Ê¥]¤§ `¯u¹ê' ¦a§}¡C )
§ó¬ÆªÌ¡M±zÁÙ¥i¥H¬M¹ï¬Û¦Pªº«Ê¥]¨ì³\¦h¤£¦Pªº¥Ø¼Ð(targets)¤W¥h¡M¦Ó¥B¥¦Ì³£¬O¦@¨Éªº¡C¨Ò¦p¡M¦pªG±z¤£·Q¬M¹ï¥ô¦óªF¦è¨ì 1.2.3.5 ¤W¥h¡M±z¥i¥H³o¼Ë°µ¡R
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 \
-j SNAT --to 1.2.3.0-1.2.3.4 --to 1.2.3.6-1.2.3.254
¦pªG¥»¾÷²£¥Íªº«Ê¥]¤§¥Øªº¦a§ïÅܤF(¨Ò¦p¡M¥Î OUTPUT Ãì)¡M¦Ó³o¼Ë·|¾ÉP«Ê¥]¥Ñ¤£¦Pªº¬É±°e¥X¥h¡M³o¼Ë¨Ó·½¦a§}¤]¸òµÛÅܬ°¨ºÓ¬É±¡CÁ|¨Ò¤l»¡¡M§ïÅܤ@ÓÀô°j(loopback)«Ê¥]¤§¥Øªº¦a¥Ñ eth0 °e¥X¡M·|Åý¨Ó·½¦a§}¤]¥Ñ 127.0.0.1 Åܦ¨ eth0 ªº¦a§}¡Q¦Ó¤£¹³¨ä¥¦¨Ó·½¦a§}¬M¹ï¨º¼Ë¡M³o¬O¥ß§Y§¹¦¨ªº¡C·íµM¡M©Ò¦³³o¨Ç¬M¹ï¦b¦^À³«Ê¥]¶i¤J®É¬OÄA˹L¨Óªº¡C