☰

使用真实 IP 从 LAN 连接到 NAT 后面的服务器

tag-icon • tag-icon routing firewall netfilter nftables
使用真实 IP 从 LAN 连接到 NAT 后面的服务器

我有一个小网络。 网络 它有一个连接到互联网 (WAN) 的防火墙，具有真实的 IP 和 DNS 名称，也充当内部网络 (LAN) 的 DHCP 服务器。在防火墙计算机上，我为位于 LAN 中的站点服务器设置了端口转发。这是我的nftables.conf：

#!/usr/sbin/nft -f

flush ruleset

define lan = eth0
define wan = eth1
define lan_addresses = 192.168.100.0/24
define server_address = 192.168.100.2
define server_http_port = 80
define server_https_port = 443

table firewall {
    map hosts {
        type ipv4_addr . ether_addr : verdict
            elements = {
                192.168.100.2  . 30:01:ED:BD:6B:CB : accept , # SERVER
                192.168.100.3  . 30:01:ED:BD:6B:C1 : accept , # CLIENT
            }
    }
    set remote_allowed {
            type ipv4_addr
            elements = { 91.198.174.192 , 209.51.188.148 }
    }
    chain prerouting {
        type nat hook prerouting priority 0; policy accept;
        # server
        iifname $wan ip protocol tcp tcp dport $server_http_port log prefix "Server HTTP Prerouted " dnat $server_address:$server_http_port
        iifname $wan ip protocol tcp tcp dport $server_https_port log prefix "Server HTTPS Prerouted " dnat $server_address:$server_https_port
    }
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        ip saddr $lan_addresses oifname $wan masquerade
        # server
        iifname $wan ip protocol tcp ip saddr $server_address tcp sport $server_http_port log prefix "Server HTTP Postrouted " masquerade
        iifname $wan ip protocol tcp ip saddr $server_address tcp sport $server_https_port log prefix "Server HTTPS Postrouted " masquerade
    }
    chain input {
        type filter hook input priority 0; policy drop;
        # drop invalid, allow established
        ct state vmap {invalid : drop, established : accept, related : accept}
        # allow loopback
        iifname "lo" accept
        # allow ping from LAN
        iifname $lan ip saddr $lan_addresses ip protocol icmp icmp type echo-request accept
        # allow SSH from LAN
        iifname != $wan ip protocol tcp tcp dport 22 accept
        # allow SSH from allowed remotes
        iifname $wan ip protocol tcp ip saddr @remote_allowed tcp dport 22 accept
        # open SQUID, DHCP port for lan
        iifname $lan ip protocol tcp ip saddr $lan_addresses tcp dport {3128, 67} accept
        # LAN nice reject
        iifname != $wan ip saddr $lan_addresses reject with icmp type host-prohibited
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
        ct state {established,related} accept
        # server
        iifname $wan ip protocol tcp ip daddr $server_address tcp dport $server_http_port log prefix "Server HTTP Forwarded To " accept
        iifname $lan ip protocol tcp ip saddr $server_address tcp sport $server_http_port log prefix "Server HTTP Forwarded From " accept
        iifname $wan ip protocol tcp ip daddr $server_address tcp dport $server_https_port log prefix "Server HTTPS Forwarded To " accept
        iifname $lan ip protocol tcp ip saddr $server_address tcp sport $server_https_port log prefix "Server HTTPS Forwarded From " accept
        # only allow selected machines to access internet
        iifname $lan oifname $wan ip saddr . ether saddr vmap @hosts
        iifname $lan oifname $wan reject
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

只要我不尝试从 LAN 访问我的服务器，此设置就可以正常工作，在这种情况下我会收到 No route to host错误消息：

> ping 192.168.100.1 # OK
> ping example.com # OK
> curl http://192.168.100.2 # OK
> curl http://192.168.100.1 # `No route to host`
> curl http://93.184.216.34 # `No route to host`
> curl http://example.com   # `No route to host`

如何修改 netfilter 配置以便可以使用防火墙 IP 或 DNS 名称访问 LAN 服务器？

PS我需要这个以便我可以正确配置吉兹见面 会议录音通过吉加西，它使用站点 URL 连接到会议。

PPS 此配置仅允许指定客户端无限制地访问互联网。

答案1

我能够在不接触防火墙配置的情况下克服这个问题。我已将包含本地服务器地址和 DNS 名称的条目添加到客户端/etc/hosts文件中：

192.168.100.3   example.com

我认为它也可以由 DHCP 服务器广播。

相关内容