我有以下设置：
- 防火墙（iptables）
- eth0 内部接口，192.168.2.10
- ppp0 外部接口，public_ip（IP 伪装）
- 服务器1（192.168.2.11），服务1（端口443）
- 服务器2（192.168.2.12），服务2（端口443）
- 客户端1（192.168.2.21）...
防火墙使用 iptables 进行以下端口转发规则：
- 端口 10000 -> 192.168.2.11:443
- 端口 10001 -> 192.168.2.12:443
这样，就可以使用公共 IP 地址和端口 10001/10002 从互联网访问这两项服务。不幸的是，client1（以及来自内部网络的其他客户端）必须使用服务器 IP/端口：它们可以使用 192.168.2.11:443 和 192.168.2.12:443 访问服务，但不能使用 public_ip:10001/10002。
也许这些问题是由于 INPUT 链与 FORWARD 链在 PREROUTING 链行为方面的差异引起的？
我该怎么做才能改变这种情况？（如果有帮助的话，我会使用“Arno 的 iptables 防火墙”脚本。）非常感谢您的指点。
编辑：这是 iptables 配置：
iptables -nvL
Chain INPUT (policy DROP 3 packets, 156 bytes)
pkts bytes target prot opt in out source destination
27362 13M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
482K 35M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
1012 57505 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
411K 31M HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
409K 31M MAC_FILTER all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 MAC_FILTER all -- tun0 * 0.0.0.0/0 0.0.0.0/0
411K 31M SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
1606 128K VALID_CHK all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
1179 108K EXT_INPUT_CHAIN !icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW
47 2340 EXT_INPUT_CHAIN icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
0 0 EXT_ICMP_FLOOD_CHAIN icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW
409K 31M LAN_INPUT_CHAIN all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 LAN_INPUT_CHAIN all -- tun0 * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `Dropped INPUT packet: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- tun0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
98717 5423K TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
41M 24G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
187 9724 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
271 17208 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
125K 7842K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
78962 5186K MAC_FILTER all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 MAC_FILTER all -- tun0 * 0.0.0.0/0 0.0.0.0/0
46489 2656K UPNP_FORWARD all -- ppp+ !ppp+ 0.0.0.0/0 0.0.0.0/0
125K 7842K SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
46489 2656K VALID_CHK all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
24 19108 ACCEPT all -- eth0 eth0 0.0.0.0/0 0.0.0.0/0
78938 5167K LAN_INET_FORWARD_CHAIN all -- eth0 ppp+ 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- tun0 tun0 0.0.0.0/0 0.0.0.0/0
0 0 LAN_INET_FORWARD_CHAIN all -- tun0 ppp+ 0.0.0.0/0 0.0.0.0/0
698 41908 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.38 tcp dpt:22
118 6564 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.38 tcp dpt:443
45546 2601K ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.38 tcp dpt:8443
0 0 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.38 tcp dpt:8899
7 364 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.37 tcp dpt:22
15 788 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.41 tcp dpt:443
105 5464 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.2.45 tcp dpt:443
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 3 LOG flags 0 level 6 prefix `Dropped FORWARD packet: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 5403 packets, 1746K bytes)
pkts bytes target prot opt in out source destination
2 120 TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
424K 66M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
437K 33M HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `FRAGMENTED PACKET (OUT): '
0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0
431K 31M EXT_OUTPUT_CHAIN all -- * ppp+ 0.0.0.0/0 0.0.0.0/0
Chain DMZ_INET_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_INPUT_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain DMZ_LAN_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain EXT_ICMP_FLOOD_CHAIN (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-request(ping) flood: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-unreachable flood: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-source-quench flood: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-time-exceeded flood: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-param.-problem flood: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP(other) flood: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_INPUT_CHAIN (2 references)
pkts bytes target prot opt in out source destination
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `TCP port 0 OS fingerprint: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `UDP port 0 OS fingerprint: '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `TCP source port 0: '
0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `UDP source port 0: '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1194
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
31 1472 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-unreachable: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-source-quench: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-time-exceeded: '
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-param.-problem: '
53 8304 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth scan (UNPRIV)?: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth scan (PRIV)?: '
85 17495 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02
167 9228 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (PRIV): '
18 1193 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (PRIV): '
481 22848 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (UNPRIV): '
172 44040 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (UNPRIV): '
870 43344 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
224 47492 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
47 2340 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 5 LOG flags 0 level 6 prefix `Other-IP connection attempt: '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_OUTPUT_CHAIN (1 references)
pkts bytes target prot opt in out source destination
431K 31M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain HOST_BLOCK (3 references)
pkts bytes target prot opt in out source destination
Chain INET_DMZ_FORWARD_CHAIN (0 references)
pkts bytes target prot opt in out source destination
Chain LAN_INET_FORWARD_CHAIN (2 references)
pkts bytes target prot opt in out source destination
354 21240 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
78584 5145K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain LAN_INPUT_CHAIN (2 references)
pkts bytes target prot opt in out source destination
18741 1705K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
390K 30M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain MAC_FILTER (4 references)
pkts bytes target prot opt in out source destination
Chain RESERVED_NET_CHK (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 10.0.0.0/8 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class A address: '
0 0 LOG all -- * * 172.16.0.0/12 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class B address: '
0 0 LOG all -- * * 192.168.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class C address: '
0 0 LOG all -- * * 169.254.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class M$ address: '
0 0 DROP all -- * * 10.0.0.0/8 0.0.0.0/0
0 0 DROP all -- * * 172.16.0.0/12 0.0.0.0/0
0 0 DROP all -- * * 192.168.0.0/16 0.0.0.0/0
0 0 DROP all -- * * 169.254.0.0/16 0.0.0.0/0
Chain SPOOF_CHK (2 references)
pkts bytes target prot opt in out source destination
488K 37M RETURN all -- eth0 * 192.168.2.0/24 0.0.0.0/0
0 0 RETURN all -- tun0 * 192.168.2.0/24 0.0.0.0/0
0 0 LOG all -- * * 192.168.2.0/24 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Spoofed packet: '
0 0 DROP all -- * * 192.168.2.0/24 0.0.0.0/0
48223 2834K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UPNP_FORWARD (1 references)
pkts bytes target prot opt in out source destination
Chain VALID_CHK (2 references)
pkts bytes target prot opt in out source destination
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS-PSH scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS-ALL scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth FIN scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth SYN/RST scan: '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth SYN/FIN scan(?): '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth Null scan: '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `Bad TCP flag(64): '
0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `Bad TCP flag(128): '
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128
380 17623 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 1 LOG flags 0 level 4 prefix `Fragmented packet: '
0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0
iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 428K packets, 31M bytes)
pkts bytes target prot opt in out source destination
697 41688 DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 to:192.168.2.38
118 6564 DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.2.38
45542 2601K DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8443 to:192.168.2.38
0 0 DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8899 to:192.168.2.38
7 364 DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:222 to:192.168.2.37:22
15 788 DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8082 to:192.168.2.41:443
105 5464 DNAT tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8083 to:192.168.2.45:443
Chain POSTROUTING (policy ACCEPT 479K packets, 34M bytes)
pkts bytes target prot opt in out source destination
49079 2610K TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
62427 3638K MASQUERADE all -- * ppp+ 192.168.2.0/24 !192.168.2.0/24
Chain OUTPUT (policy ACCEPT 432K packets, 31M bytes)
pkts bytes target prot opt in out source destination
答案1
谢谢，搜索“Hairpin NAT”的提示帮助我解决了我的问题。对于其他感兴趣的用户，以下是产生神奇效果的规则：
iptables -t nat -A PREROUTING -d $EXT_IP -p tcp --dport 443 -j DNAT --to-destination $OFFICE
iptables -t nat -A POSTROUTING -s $INT_NET -d $SERVER-p tcp --dport 443 -j SNAT --to-source $FIREWALL
感谢您的帮助！