操作基于ubuntu server10.10 上进行安装配置.进行配置iptables.ip转换.mac过虑功能.
1.建iptables
root@ptubuntufirewall:/# vi /etc/init.d/iptables
#fLUSH THE FILTER,NAT,Mangle chain!/sbin/iptables -F -t filter/sbin/iptables -F -t nat/sbin/iptables -F -t mangle#Flush the user's chain/sbin/iptables -t filter -X/sbin/iptables -t nat -X/sbin/iptables -t mangle -X#Set default policies to DROP/sbin/iptables -P INPUT ACCEPT/sbin/iptables -P OUTPUT ACCEPT/sbin/iptables -P FORWARD ACCEPT#LAN NAT/sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/255.255.255.0 -o eth1 -j MASQUERADE#/sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/255.255.255.0 -o eth0 -j MASQUERADEif [ -f /etc/access_mac.conf ]thenfor i in `cat /etc/access_mac.conf | grep "^[^#]" | tr -s "[\012]" | cut -c1-17` ; do/sbin/iptables -A FORWARD -m mac –mac-source $i -i eth0 -j ACCEPTdonefi/sbin/iptables -A FORWARD -i eth0 -j DROP#VNC View Ptubuntu 这下面两条指:访问外网ip可以转换到内网ip:端口/sbin/iptables -A PREROUTING -t nat -p tcp -m tcp -i eth1 –dport 5888 -j DNAT –to-destination 192.168.0.110:5888/sbin/iptables -A PREROUTING -t nat -p tcp -m tcp -i eth1 –dport 5988 -j DNAT –to-destination 192.168.0.110:5988