---
title: "iptables和firewall-cmd配置NAT转发重定向"
id: "280"
type: "post"
slug: "iptables%e5%92%8cfirewall-cmd%e9%85%8d%e7%bd%aenat%e8%bd%ac%e5%8f%91%e9%87%8d%e5%ae%9a%e5%90%91"
published_at: "2020-05-17T12:35:03+00:00"
modified_at: "2021-11-28T08:16:03+00:00"
url: "https://www.hitsword.org/2020/280.html"
markdown_url: "https://www.hitsword.org/2020/280.md"
excerpt: "在做NAT转发网关时,有些站点需要做劫持重定向,把一些下载站点重定向到本地的一个镜像节点。 例如mirrors […]"
taxonomy_category:
  - "Centos"
  - "网关"
taxonomy_post_tag:
  - "firewall-cmd"
  - "iptables"
  - "NAT"
  - "防火墙"
---

# iptables和firewall-cmd配置NAT转发重定向

在做NAT转发网关时,有些站点需要做劫持重定向,把一些下载站点重定向到本地的一个镜像节点。  
 例如mirrors.163.com的IP是59.111.0.251,重定向到本地192.168.1.100  
 iptables命令:

```
iptables -A PREROUTING -d 59.111.0.251/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.100
```

  
  
 firewall-cmd命令:  
```
firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 destination address=59.111.0.251/32 forward-port port=80 protocol=tcp to-port=80 to-addr=192.168.1.100" --permanent
firewall-cmd --reload
firewall-cmd --list-all
```

firewall-cmd劫持dns命令：

```
firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=192.168.1.0/24 forward-port port=53 protocol=tcp to-port=53 to-addr=192.168.1.1" --permanent
firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=192.168.1.0/24 forward-port port=53 protocol=udp to-port=53 to-addr=192.168.1.1" --permanent
```

另附firewall-cmd开启NAT转发命令:

```
firewall-cmd --query-masquerade # 检查是否开启NAT
firewall-cmd --add-masquerade # 开启NAT
firewall-cmd --remove-masquerade# 关闭NAT
```