Network 1怎麼連接這兩個子網呢?注意到,他們的網段是重疊的。
192.168.150.0 (Corporate)
--------------/-------------------------
Network 2
192.168.150.0 (Untrusted Network)
Network 1
192.168.150.0 (Corp)
|
Network 2 |
192.168.180.0 (Intermediate)
|
NAT BOX 1 |
eth0 192.168.180.180
eth1 10.15.15.1
|
NAT BOX 2 |
eth0 10.15.15.2
eth1 192.168.150.252
|
Newtwork 3 |
192.168.150.0 (Untrusted Network)
在NAT BOX 1, 給eth0建立三個別名.
ifconfig eth0:0 192.168.180.181.netmask 255.255.255.0
ifconfig eth0:1 192.168.180.182 netmask 255.255.255.0
ifconfig eth0:2 192.168.180.183 netmask 255.255.255.0
NAT BOX 2也是。
ifconfig eth0:0 10.15.15.181 netmask 255.255.255.0
ifconfig eth0:1 10.15.15.182 netmask 255.255.255.0
ifconfig eth0:2 10.15.15.183 netmask 255.255.255.0
接下來給出iptables的,你一看應該就會明白了:
在NAT BOX 1給eth0做三個DNAT:
iptables -t nat -A PREROUTING -d 192.168.180.181 -i eth0 \
-j DNAT --to-destination 10.15.15.181
iptables -t nat -A PREROUTING -d 192.168.181.182 -i eth0 \
-j DNAT --to-destination 10.15.15.182
iptables -t nat -A PREROUTING -d 192.168.181.183 -i eth0 \
-j DNAT --to-destination 10.15.15.183
還有一個SNAT:
iptables -A POSTROUTING -s 192.168.150.0/255.255.255.0 \
-d 10.15.15.0/255.255.255.0 -j SNAT -o eth1 \
--to-source 10.15.15.1
網段2也類似
iptables -t nat -A PREROUTING -d 10.15.15.181 -i eth0 \
-j DNAT --to-destination 192.168.150.10
iptables -t nat -A PREROUTING -d 10.15.15.182 -i eth0 \
-j DNAT --to-destination 192.168.150.11
iptables -t nat -A PREROUTING -d 10.15.15.183 -i eth0 \
-j DNAT --to-destination 192.168.150.12
iptables -A POSTROUTING -s 10.15.15.0/24 \
-d 192.168.150.0/24 -j SNAT -o eth1 \
--to-source 192.168.150.252
好了,現在目的是達到了,但缺點很明顯的——維護起來太麻煩了。呵呵,我說過的這是Haker-Style的解決辦法。