shorewall 포트 포워딩 문제
안녕하세요?
shorewall 을 설치하고 port forwarding을 하려고 하는데
안되서 이렇게 질문 드립니다.
eth0 : xxx.xxx.xxx.xxx 외부
eth1 : 192.168.0.150 내부
kernel : 2.6.22-gentoo-r5
iptables-1.3.8-r2
shorewall-3.4.6
iproute2-2.6.22.20070710
설치된 상태이고 , shorewall 설정은 아래와 같습니다.
/etc/shorewall/shorewall.conf
STARTUP_ENABLED=Yes
IP_FORWARDING=On
/etc/shorewall/interface
net eth0 detect routeback,tcpflags,blacklist
loc eth1 detect routeback,tcpflags,blacklist
/etc/shorewall/zones
fw firewall
net ipv4
loc ipv4
/etc/shorewall/policy
loc net ACCEPT
loc $FW ACCEPT
$FW net ACCEPT
net $FW DROP info
net all DROP info
all all REJECT info
/etc/shorewall/rules
SECTION NEW
DNAT net loc:192.168.0.133:21 tcp 15671
DNAT net loc:192.168.0.133:21 udp 15671
# shorewall show nat
명령으로 확인해보면 아래와 같이 나옵니다.
Chain PREROUTING (policy ACCEPT 2227 packets, 299K bytes)
pkts bytes target prot opt in out source destination
389 30858 net_dnat all -- eth0 * 0.0.0.0/0 0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 11 packets, 2502 bytes)
pkts bytes target prot opt in out source destination
11 2502 eth0_masq all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 31 packets, 7302 bytes)
pkts bytes target prot opt in out source destination
Chain eth0_masq (1 references)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * * 192.168.0.0/24 0.0.0.0/0
Chain net_dnat (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- * * 0.0.0.0/0 xxx.xxx.xxx.xxx tcp dpt:15671 to:192.168.0.133:21
0 0 DNAT udp -- * * 0.0.0.0/0 xxx.xxx.xxx.xxx udp dpt:15671 to:192.168.0.133:21하지만 포워딩은 안되고,
iptables 명령으로 해보면 포워딩 잘되고요.
하지만 메세지가 좀 다르게 나옵니다.
# iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 15671 -j DNAT --to 192.168.0.133:21
# shorewall show nat
Chain PREROUTING (policy ACCEPT 2227 packets, 299K bytes) pkts bytes target prot opt in out source destination 0 0 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5671 to:192.168.0.133:21 Chain POSTROUTING (policy ACCEPT 11 packets, 2502 bytes) pkts bytes target prot opt in out source destination 134K 11M MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 0 0 SNAT all -- * eth0 0.0.0.0/0 0.0.0.0/0 to:xxx.xxx.xxx.xxx Chain OUTPUT (policy ACCEPT 31 packets, 7302 bytes) pkts bytes target prot opt in out source destination
이렇게 나옵니다.
PREROUTING 이 부분에 추가되야 될것 같고...
POSTROUTING 이 부분도 추가 되야 될것 같은데 ...
어떻게 해야될지 모르겠네요.
조언 좀 부탁드립니다.
읽어주셔셔 감사합니다.
오늘도 좋은하루 되세요 ^^*