（十）、iptables进行转发使内网能上网

中小型规模网站集群架构:iptables控制内网上网

： Ago linux运维群：93324526

---

前言：

你想上网，但是又不想别人攻击你，怎么办。那就让iptables拥有转发nat的功能吧。

管理机

modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_state
echo \'net.ipv4.ip_forward = 1\' >> /etc/sysctl.conf
sysctl -p
iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o eth0 -j SNAT --to-source 10.0.0.61

其他机子

sed -i \'s#ONBOOT=yes#ONBOOT=no#g\' /etc/sysconfig/network-scripts/ifcfg-eth0
echo -e \'DNS1=223.5.5.5\nDNS2=8.8.8.8\nGATEWAY=172.16.1.61\' >> /etc/sysconfig/network-scripts/ifcfg-eth1
/etc/init.d/network restart

剧本
/etc/ansible/hosts
[in_net]
172.16.1.8
172.16.1.7
172.16.1.41
172.16.1.31
172.16.1.51

---
- hosts: 172.16.1.61
  tasks:
  - name: "out network"
    shell: modprobe iptable_nat;modprobe iptable_filter;modprobe ip_conntrack;modprobe ip_conntrack_ftp;modprobe ip_nat_ftp;modprobe ipt_state;echo \'net.ipv4.ip_
forward = 1\' >> /etc/sysctl.conf;sysctl -p;iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o eth0 -j SNAT --to-source 10.0.0.61
    ignore_errors: True
- hosts: in_net
  tasks:
  - name: "change network"
    shell: sed -i \'s#ONBOOT=yes#ONBOOT=no#g\' /etc/sysconfig/network-scripts/ifcfg-eth0;echo -e \'DNS1=223.5.5.5\nDNS2=8.8.8.8\nGATEWAY=172.16.1.61\' >> /etc/syscon
fig/network-scripts/ifcfg-eth1
  - name: "rpcbind start..."
    service:
      name: network
      state: started