CentOS6 iptables DNAT

1.  

   eth0  is the inner interface   (10.10.60.0/24)
   eth1  is the outer interface   (111.111.111.0/24)

   inner server 10.10.60.1 , listen port 22

   outer server 111.111.111.10 / 10.10.60.2 ,  open 3456 to redirect to 10.10.60.1:22

   client ip 222.222.222.222

2. 

111.111.111.10's iptables

NAT table

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# client connect to 111.111.111.10:3456 , and forwarding to 10.10.60.1:22

-A PREROUTING -i eth1 -p tcp -s 222.222.222.222 --dport 3456 -j DNAT --to-destination 10.10.60.1:3306

# MASQUERADE way also works
#-A POSTROUTING -o eth0 -d 10.10.60.1 -p tcp --dport 22 -j MASQUERADE

-A POSTROUTING -o eth0 -p tcp -d 10.10.60.1 --dport 22 -j SNAT --to-source 10.10.60.2

COMMIT


Filter Table

#client 222.222.222.222 connect to 111.111.111.111:3456 will redirect to 10.10.60.1:22 and let port forwarding

-A FORWARD -i eth1 -p tcp -s 222.222.222.222 --dport 22 -j ACCEPT

-A FORWARD -i eth0 -p tcp -s 10.10.60.1 --sport 22 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

3.

 10.10.60.1 needs to allow 10.10.60.2 to connect 22 port

CentOS6 Tomcat6 SSL Settings

1. 產生憑證

keytool -genkey -alias tomcat -keyalg RSA

2. 複製憑證(.keystore)到

/usr/share/tomcat6

3. 修改 /etc/tomcat6/server.xml

                   maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               keystoreFile="${user.home}/.keystore" keystorePass="changeit"
    





4. 如果要把 8443 改到 443

用port redirect 作法
修改 /etc/sysconfig/iptables

在*filter 前面
加上 NAT的部份


#NAT部份
#把  443 轉到 tomcat ssl 8443
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to-destination :8443
-A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination :8080

-I OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-ports 8080

COMMIT