目录
1、内部网络中的pc1采用SNAT访问外部互联网,但是无法ping到内部网关。
3、互联网主机pc2能够访问s1区域的服务器,但是不能够进行ping和ssh连接。
一、操作前准备:
1、准备4个Rocky8虚拟机
2、网络规划
-
内部PC1位于内网区域,地址段为: 192.168.1.0/24,pc1地址为:192.168.1.1/24,网关地址为:192.168.1.254/24
-
服务器S1位于服务器区域,地址段为: 192.168.2.0/24,pc1地址为:192.168.2.1/24,网关地址为:192.168.2.254/24
-
PC2位于互联网区域,模拟外部互联网,地址段为:10.0.0.0/8,pc2地址为:10.0.0.1/8
-
Linux防火墙的三块网卡为别连接不同的网络区域,地址分别为 :ens33 192.168.1.254/24;ens34 10.0.0.100/8;ens35 192.168.2.254/24
防火墙要求
-
内部网络中的pc1采用SNAT访问外部互联网,但是无法ping到内部网关。
-
内部网络服务器s1通过DNAT发布服务到互联网。
-
互联网主机pc2能够访问s1区域的服务器,但是不能够进行ping和ssh连接。

虚拟机配置
内部网络PC1
[root@pc1 ~]# cd /etc/sysconfig/network-scripts/
[root@pc1 network-scripts]# ls
ifcfg-ens33
[root@pc1 network-scripts]# vim ifcfg-ens33
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.1.1
PREFIX=24
GATEWAY=192.168.1.254
~
#关闭NetworkManager、firewalld和selinux,后面虚拟机配置同样操作该步骤#
[root@pc1 network-scripts]# systemctl stop NetworkManager
[root@pc1 network-scripts]# systemctl stop firewalld
[root@pc1 network-scripts]# setenforce 0
[root@pc1 network-scripts]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:5b:74:6c brd ff:ff:ff:ff:ff:ff
altname enp2s1
inet 192.168.1.1/24 brd 192.168.1.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe5b:746c/64 scope link
valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:3f:34:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
服务器s1
[root@s1 ~]# cd /etc/sysconfig/network-scripts/
[root@s1 network-scripts]# ls
ifcfg-ens33
[root@s1 network-scripts]# vim ifcfg-ens33
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.2.1
PREFIX=24
GATEWAY=192.168.2.254
~
~
#关闭NetworkManager、firewalld和selinux#
[root@s1 network-scripts]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:65:02:34 brd ff:ff:ff:ff:ff:ff
altname enp2s1
inet 192.168.2.1/24 brd 192.168.2.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe65:234/64 scope link
valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:3f:34:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
外部网络pc2
[root@pc2 ~]# cd /etc/sysconfig/network-scripts/
[root@pc2 network-scripts]# ls
ifcfg-ens33
[root@pc2 network-scripts]# vim ifcfg-ens33
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR=10.0.0.1
PREFIX=8
~
#关闭NetworkManager、firewalld和selinux#
[root@pc2 network-scripts]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:97:34:23 brd ff:ff:ff:ff:ff:ff
altname enp2s1
inet 10.0.0.1/8 brd 10.255.255.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe97:3423/64 scope link
valid_lft forever preferred_lft forever
3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:3f:34:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
Linux防火墙sf1
##增加两块网卡##

[root@sf1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:97:34:23 brd ff:ff:ff:ff:ff:ff
altname enp2s1
inet 192.168.58.133/24 brd 10.255.255.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe97:3423/64 scope link
valid_lft forever preferred_lft forever
3: ens34: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
link/ether 00:0c:29:97:34:2d brd ff:ff:ff:ff:ff:ff
altname enp2s2
4: ens37: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
link/ether 00:0c:29:97:34:37 brd ff:ff:ff:ff:ff:ff
altname enp2s5
5: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:3f:34:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
[root@sf1 ~]# cd /etc/sysconfig/network-scripts/
[root@sf1 network-scripts]# ls
ifcfg-有线连接_1 ifcfg-ens33
[root@sf1 network-scripts]# cp ifcfg-ens33 ifcfg-en34
[root@sf1 network-scripts]# cp ifcfg-ens33 ifcfg-en37
[root@sf1 network-scripts]# ls
ifcfg-有线连接_1 ifcfg-ens33 ifcfg-ens34 ifcfg-ens37
[root@sf1 network-scripts]# vim ifcfg-ens33
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.1.254
PREFIX=24
[root@sf1 network-scripts]# vim ifcfg-ens34
TYPE=Ethernet
BOOTPROTO=static
NAME=ens34
DEVICE=ens34
ONBOOT=yes
IPADDR=192.168.2.254
PREFIX=24
[root@sf1 network-scripts]# vim ifcfg-ens37
TYPE=Ethernet
BOOTPROTO=static
NAME=ens37
DEVICE=ens37
ONBOOT=yes
IPADDR=10.0.0.100
PREFIX=8
~
[root@s1 ~]# vim /etc/sysctl.conf
# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).
net.ipv4.ip_forward = 1
#关闭NetworkManager、firewalld和selinux#
[root@sf1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:53:17:48 brd ff:ff:ff:ff:ff:ff
altname enp2s1
inet 192.168.1.254/24 brd 192.168.1.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe53:1748/64 scope link
valid_lft forever preferred_lft forever
3: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:53:17:52 brd ff:ff:ff:ff:ff:ff
altname enp2s2
inet 192.168.2.254/24 brd 192.168.2.255 scope global noprefixroute ens34
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe53:1752/64 scope link
valid_lft forever preferred_lft forever
4: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:53:17:5c brd ff:ff:ff:ff:ff:ff
altname enp2s5
inet 10.0.0.100/8 brd 10.255.255.255 scope global noprefixroute ens37
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe53:175c/64 scope link
valid_lft forever preferred_lft forever
5: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:3f:34:5d brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
更改网络模式:
pc1:选用VMnet2
s1:选用VMnet3
pc2:选用VMnet4
sf1:分别选用VMnet2、选用VMnet3、选用VMnet4

sf1:

二、操作前连接测试
#pc1网络测试#
[root@pc1 ~]# ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=63 time=0.531 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=63 time=0.683 ms
64 bytes from 192.168.2.1: icmp_seq=3 ttl=63 time=0.722 ms
64 bytes from 192.168.2.1: icmp_seq=4 ttl=63 time=1.20 ms
^C
--- 192.168.2.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3070ms
rtt min/avg/max/mdev = 0.531/0.784/1.202/0.252 ms
[root@pc1 ~]# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
^C
--- 10.0.0.1 ping statistics ---
8 packets transmitted, 0 received, 100% packet loss, time 7190ms
[root@pc1 ~]# ping 10.0.0.100
PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.254 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.602 ms
64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.374 ms
^C
--- 10.0.0.100 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2080ms
rtt min/avg/max/mdev = 0.254/0.410/0.602/0.144 ms
#ping 192.168.2.1和ping 10.0.0.100通了,但ping 10.0.0.1不通#
#s1网络测试#
[root@s1 ~]# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=63 time=0.537 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=63 time=1.78 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=63 time=0.746 ms
^C
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2017ms
rtt min/avg/max/mdev = 0.537/1.020/1.777/0.542 ms
[root@s1 ~]# ping 10.0.0.100
PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.311 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=1.32 ms
64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.426 ms
^C
--- 10.0.0.100 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2037ms
rtt min/avg/max/mdev = 0.311/0.687/1.324/0.452 ms
[root@s1 ~]# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
^C
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2050ms
#ping 192.168.1.1和ping 10.0.0.100通了,但ping 10.0.0.1不通#
#pc2网络测试#
[root@pc2 ~]# ping 192.168.1.1
connect: 网络不可达
[root@pc2 ~]# ping 192.168.2.1
connect: 网络不可达
[root@pc2 ~]# ping 192.168.1.254
connect: 网络不可达
[root@pc2 ~]# ping 192.168.2.254
connect: 网络不可达
[root@pc2 ~]# ping 10.0.0.100
PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.278 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.280 ms
64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=0.412 ms
64 bytes from 10.0.0.100: icmp_seq=4 ttl=64 time=0.565 ms
^C
--- 10.0.0.100 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3108ms
rtt min/avg/max/mdev = 0.278/0.383/0.565/0.120 ms
#ping 192.168.1.1和ping 192.168.2.1和ping 192.168.1.254和ping 192.168.2.254不通,但ping 10.0.0.100能通#
三、操作成果
1、内部网络中的pc1采用SNAT访问外部互联网,但是无法ping到内部网关。
[root@sf1 ~]# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ens37 -j SNAT --to 10.0.0.100
[root@sf1 ~]# iptables -t nat -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 192.168.1.0/24 0.0.0.0/0 to:10.0.0.100
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain LIBVIRT_PRT (0 references)
target prot opt source destination
[root@pc1 ~]# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=2.23 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=0.915 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=1.53 ms
^C
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2010ms
rtt min/avg/max/mdev = 0.915/1.559/2.229/0.537 ms
[root@pc1 ~]# curl 10.0.0.1
2025/02/04
[root@pc1 ~]# ping 192.168.1.254
PING 192.168.1.254 (192.168.1.254) 56(84) bytes of data.
64 bytes from 192.168.1.254: icmp_seq=1 ttl=64 time=0.265 ms
64 bytes from 192.168.1.254: icmp_seq=2 ttl=64 time=0.530 ms
64 bytes from 192.168.1.254: icmp_seq=3 ttl=64 time=0.390 ms
64 bytes from 192.168.1.254: icmp_seq=4 ttl=64 time=0.598 ms
^C
--- 192.168.1.254 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3111ms
rtt min/avg/max/mdev = 0.265/0.445/0.598/0.131 ms
[root@sf1 ~]# iptables -t filter -A INPUT -p icmp --icmp-type 8 -j DROP
[root@sf1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain LIBVIRT_INP (0 references)
target prot opt source destination
[root@pc1 ~]# ping 192.168.1.254
PING 192.168.1.254 (192.168.1.254) 56(84) bytes of data.
^C
--- 192.168.1.254 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2048ms
[root@pc1 ~]# curl 10.0.0.1
2025/02/04
2、内部网络服务器s1通过DNAT发布服务到互联网。
[root@pc2 yum.repos.d]# curl 10.0.0.100
curl: (7) Failed to connect to 10.0.0.100 port 80: 拒绝连接
[root@sf1 ~]# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.2.1:80
##或者##
[root@sf1 ~]# iptables -t nat -A PREROUTING -i ens37 -d 10.0.0.100 -p tcp --dport 80 -j DNAT --to-destination 192.168.2.1
[root@pc2 yum.repos.d]# curl 10.0.0.100
2025/6/3
3、互联网主机pc2能够访问s1区域的服务器,但是不能够进行ping和ssh连接。
[root@pc2 ~]# ping 10.0.0.100
PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=64 time=0.345 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=64 time=0.963 ms
64 bytes from 10.0.0.100: icmp_seq=3 ttl=64 time=2.02 ms
64 bytes from 10.0.0.100: icmp_seq=4 ttl=64 time=1.17 ms
^C
--- 10.0.0.100 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3035ms
rtt min/avg/max/mdev = 0.345/1.123/2.018/0.599 ms
root@pc2 \~\]# ssh [email protected] The authenticity of host '10.0.0.100 (10.0.0.100)' can't be established. ECDSA key fingerprint is SHA256:kzaygOfzCdFhwGd4z5fLArfCyG/4uXhRNZ72DuBqKSA. Are you sure you want to continue connecting (yes/no/\[fingerprint\])? yes Warning: Permanently added '10.0.0.100' (ECDSA) to the list of known hosts. [email protected]'s password: Activate the web console with: systemctl enable --now cockpit.socket Last login: Tue Jun 3 23:25:14 2025 \[root@sf1 \~\]# exit 注销 Connection to 10.0.0.100 closed. \[root@sf1 \~\]# iptables -A INPUT -s 10.0.0.1 -p icmp --icmp-type 8 -j DROP \[root@sf1 \~\]# iptables -A INPUT -s 10.0.0.1 -p tcp --dport 22 -j DROP \[root@sf1 \~\]# iptables -nL Chain INPUT (policy ACCEPT) target prot opt source destination DROP icmp -- 10.0.0.1 0.0.0.0/0 icmptype 8 DROP tcp -- 10.0.0.1 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination \[root@pc2 \~\]# ssh [email protected] \^C \[root@pc2 \~\]# ping 10.0.0.100 PING 10.0.0.100 (10.0.0.100) 56(84) bytes of data. 看到感觉有帮助的朋友劳烦动动发财的小手,给博主点个赞