无法从外部 IP 连接 ufw/iptables 转发端口

无法从外部 IP 连接 ufw/iptables 转发端口

我使用 ufw 和 iptable 配置将服务器中的端口 25 转发到 53525。(ubuntu 14.04)

它是通过 telnet 命令测试的端口,所以我尝试测试它。

与本地主机的 25 端口连接良好,但无法从外部计算机连接。

我确实检查过了网络状态监测结果,我的 25 端口没有列出。但端口 53525 列出了。

附上我的 ufw / iptables 配置。请帮忙。

文件:/etc/ufw/before.rules

*nat
:PREROUTING ACCEPT [0:0]
-A OUTPUT -p tcp --dport 25 -j REDIRECT --to-port 53525
-A OUTPUT -p tcp --dport 143 -j REDIRECT --to-port 54143
-A OUTPUT -p tcp --dport 445 -j REDIRECT --to-port 54445
-A OUTPUT -p tcp --dport 139 -j REDIRECT --to-port 54139
-A OUTPUT -p tcp --dport 173 -j REDIRECT --to-port 54173
-A OUTPUT -p tcp --dport 138 -j REDIRECT --to-port 54138
-A OUTPUT -p tcp --dport 1025 -j REDIRECT --to-port 53525
COMMIT

命令:iptables -t nat -L

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
DOCKER     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
DOCKER     all  --  anywhere            !loopback/8           ADDRTYPE match dst-type LOCAL
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:1025 redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:smtp redir ports 53525
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:imap2 redir ports 54143
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds redir ports 54445
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn redir ports 54139
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:173 redir ports 54173
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm redir ports 54138
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:1025 redir ports 53525

命令:ufw status

22                         ALLOW       Anywhere
80                         ALLOW       Anywhere
25                         ALLOW       Anywhere
110                        ALLOW       Anywhere
143                        ALLOW       Anywhere
443                        ALLOW       Anywhere
465                        ALLOW       Anywhere
587                        ALLOW       Anywhere
993                        ALLOW       Anywhere
995                        ALLOW       Anywhere
4190                       ALLOW       Anywhere
3389                       ALLOW       Anywhere
8083                       ALLOW       Anywhere
22 (v6)                    ALLOW       Anywhere (v6)
80 (v6)                    ALLOW       Anywhere (v6)
25 (v6)                    ALLOW       Anywhere (v6)
110 (v6)                   ALLOW       Anywhere (v6)
143 (v6)                   ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)
465 (v6)                   ALLOW       Anywhere (v6)
587 (v6)                   ALLOW       Anywhere (v6)
993 (v6)                   ALLOW       Anywhere (v6)
995 (v6)                   ALLOW       Anywhere (v6)
4190 (v6)                  ALLOW       Anywhere (v6)
3389 (v6)                  ALLOW       Anywhere (v6)
8083 (v6)                  ALLOW       Anywhere (v6)

答案1

如果您希望到服务器端口 25 的外部连接透明地转到端口 53525,那么您需要在 PREROUTING 链的 mangle 表中添加 DNAT 规则。

就像是

iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination :53525

您可能需要 POSTROUTING/SNAT 规则来映射传出数据包中的端口:

iptables -t nat -A POSTROUTING -p tcp --sport 53525 -j SNAT --to-source :25

相关内容