当前位置： 文江博客话题详情

iptables：复制/转发端口

发布于 2024-11-07 21:38:47 字数 6423 浏览 0 评论 0原文

我正在尝试从阻止此端口的网络连接到 MySQL（端口 3306）。但还有另一个端口 110 开放，我可以将其用于本例。我正在将 MySQL 用于其他应用程序，因此我不能简单地更改端口。

我现在正在尝试通过 iptables 设置端口转发。确切地说，我想将110转发到3306而不阻止3306。

我花了很多时间谷歌搜索，但我无法让它工作。我也有点担心把我锁在外面。你们中的任何人都可以给我提示吗？

非常感谢！

#~ iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `INPUT INVALID ' 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
DROP       all  --  anywhere             anywhere            state INVALID 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN/FIN,SYN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp source-quench 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded 
ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssmtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3s 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imap2 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imaps 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nntp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:domain 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:ntp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:6060 
MY_REJECT  all  --  anywhere             anywhere            
MY_REJECT  all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `OUTPUT INVALID ' 
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
MY_REJECT  all  --  anywhere             anywhere            

Chain MY_DROP (7 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP ' 
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP ' 
DROP       all  --  anywhere             anywhere            

Chain MY_REJECT (3 references)
target     prot opt source               destination         
LOG        tcp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP ' 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
LOG        tcp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP ' 
LOG        udp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP ' 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable 
LOG        udp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP ' 
DROP       icmp --  anywhere             anywhere            
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable 
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER ' 
LOG        icmp --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `DROP ICMP ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable 
DROP       icmp --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable
原文

I'm trying to connect to MySQL (Port 3306) from a network which blocks this port. But there is another port 110 open which I can use for this case. I'm using MySQL for other applications so I can't just simply change the port.

I'm now trying to set up port forwarding via iptables. To be exact I want to forward 110 to 3306 without blocking 3306.

I've spent a lot of time googling, but I couldn't get it working. I'm also a little worried about locking me out. Can any of you give me a hint?

Thank you very much!

#~ iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `INPUT INVALID ' 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
DROP       all  --  anywhere             anywhere            state INVALID 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN/FIN,SYN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp source-quench 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded 
ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssmtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3s 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imap2 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imaps 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nntp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:domain 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:ntp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:6060 
MY_REJECT  all  --  anywhere             anywhere            
MY_REJECT  all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `OUTPUT INVALID ' 
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
MY_REJECT  all  --  anywhere             anywhere            

Chain MY_DROP (7 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP ' 
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP ' 
DROP       all  --  anywhere             anywhere            

Chain MY_REJECT (3 references)
target     prot opt source               destination         
LOG        tcp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP ' 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
LOG        tcp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP ' 
LOG        udp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP ' 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable 
LOG        udp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP ' 
DROP       icmp --  anywhere             anywhere            
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable 
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER ' 
LOG        icmp --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `DROP ICMP ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable 
DROP       icmp --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论， 你可以免费 注册 一个本站的账号。

评论（2）

酒废 2024-11-14 21:38:47

在 ubuntu 上使用 iptables 转发端口时，您必须：

  • 备份防火墙设置

sudo iptables-save > iptables.backup

  • 确保入口端口已打开

sudo ufw allowed 110/tcp

  • 在防火墙中添加预路由规则

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 110 -j REDIRECT --to-port 3306

请注意 -i eth0 的使用。这会将端口 110 路由到网络 eth0 上的 3306。要检查机器的所有连接，请使用ifconfig。
如果您的计算机连接到多个网络，则必须使用 -i ，否则它将无法工作！

  • 如果您搞砸了某些内容，您可以清理 NAT 路由表使用

sudo iptables -F -t nat

或恢复 iptables

sudo iptables-restore iptables.backup

When forwarding ports on ubuntu using iptables, you must:

  • make a backup of your firewall settings

sudo iptables-save > iptables.backup

  • make sure the entry port is open

sudo ufw allow 110/tcp

  • add a prerouting rule in your firewall

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 110 -j REDIRECT --to-port 3306

Notice the use of -i eth0. This routes port 110 to 3306 on network eth0. To check all connection of your machine, use ifconfig.
If your machine is connected to multiple networks, you must use -i <network> or it will not work!

  • if you mess something up you can clean the NAT routing table with

sudo iptables -F -t nat

or restore iptables

sudo iptables-restore < iptables.backup

回复 原文
纸短情长 2024-11-14 21:38:47

这可能有效，尚未测试。

iptables -t nat -A PREROUTING -p tcp --dport 110 -j REDIRECT --to-port 3306

This might work, haven't tested it.

iptables -t nat -A PREROUTING -p tcp --dport 110 -j REDIRECT --to-port 3306
回复 原文
~没有更多了~

关于作者

上课铃就是安魂曲

暂无简介

0 文章
0 评论
23 人气
发私信

相关话题

更多

热门标签

操作系统 程序设计 IT运维 Linux系统管理 JavaScript 服务器应用 solaris C/C++ PHP Shell BSD Vue.js aix Oracle Python HTML 系统管理 HTML5 CSS 前端
更多

推荐作者

lorenzathorton8

文章 0 评论 0

Zero

文章 0 评论 0

萧瑟寒风

文章 0 评论 0

mylayout

文章 0 评论 0

tkewei

文章 0 评论 0

17818769742

文章 0 评论 0

更多

友情链接

文江博客
    我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
    原文