1 目標
使內網主機通過網關主機訪問外網。
2 前置條件
2.1 網關主機 Router
兩塊網卡：
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:c8:27:4f brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic enp0s3
valid_lft 86025sec preferred_lft 86025sec
inet6 fe80::a00:27ff:fec8:274f/64 scope link
valid_lft forever preferred_lft forever
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:4a:27:99 brd ff:ff:ff:ff:ff:ff
inet 192.168.56.111/24 brd 192.168.56.255 scope global dynamic enp0s8
valid_lft 508sec preferred_lft 508sec
inet6 fe80::a00:27ff:fe4a:2799/64 scope link
valid_lft forever preferred_lft forever
10.0.2.15 可以上外網
192.168.56.111 為內網卡
2.2 客戶機 Client
2: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:79:02:15 brd ff:ff:ff:ff:ff:ff
inet 192.168.56.113/24 brd 192.168.56.255 scope global enp0s8
valid_lft forever preferred_lft forever
inet6 fe80::a00:27ff:fe79:215/64 scope link
valid_lft forever preferred_lft forever
3 開工
3.1 網關主機
建立服務腳本：
root@gateway:~# cat /usr/local/src/become-a-router.sh
#!/bin/bash
/usr/bin/echo 1 >> /proc/sys/net/ipv4/ip_forward
/usr/sbin/iptables -t nat -A POSTROUTING -s 192.168.56.0/24 -j MASQUERADE
建立 systemd service 文件：
root@gateway:~# cat /usr/lib/systemd/system/become-a-router.service
[Unit]
Description=Become a router
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/local/src/become-a-router.sh
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
注冊服務並加入開機運行：
systemctl daemon-reload
systemctl start become-a-router.service
systemctl enable become-a-router.service
3.2 客戶機配置 IP 地址並指定網關
root@client1:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# 1
auto enp0s3
allow-hotplug enp0s3
iface enp0s3 inet dhcp
# 2
auto enp0s8
allow-hotplug enp0s8
iface enp0s8 inet static
address 192.168.56.113
netmask 255.255.255.0
gateway 192.168.56.111
# dns-nameservers 8.8.8.8
4 測試
4.1 網關查看 iptables
root@gateway:~# iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 192.168.56.0/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
4.2 客戶機訪問外網
root@client1:~# ping www.126.com
PING www.126.com (220.181.12.218) 56(84) bytes of data.
64 bytes from www.126.com (220.181.12.218): icmp_seq=1 ttl=61 time=69.9 ms
64 bytes from www.126.com (220.181.12.218): icmp_seq=2 ttl=61 time=71.2 ms
5 大功告成
6 注意事項
調用程序時，要注意路徑的引用問題，發行版本不同，調用的路徑也許不同。