blocks|key|3145819|text|尝试使用DNAT，而不是使用SNAT。源端口被更改，因为SNAT意味着SourceNAT，所以DNAT将为您工作。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3145820|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Instead of making SNAT, try with DNAT. The source port gets changed because SNAT means SourceNAT, so DNAT will work for you.

blocks|key|359067|text|@PiedPiper是对的。使用DNAT时，您必须指定ip地址，但我们只想进行端口重定向，因此-j重定向在这种情况下可能会起作用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|359068|请参阅http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html#ss6.2|offset|length|359069|entityMap|0|LINK|mutability|MUTABLE|url|http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html#ss6.2^0|0|3|1W|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

@PiedPiper was right. With DNAT you must specify an ip address, but we only want to do port redirection, so -j REDIRECT may work in this case.

See <a href="http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html#ss6.2" rel="nofollow noreferrer">http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html#ss6.2</a>

blocks|key|356894|text|假设您知道要发送到哪台机器：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|356895|iptables+-t+nat+-A+OUTPUT+-p+udp+--dport+162+-j+DNAT+--to-destination+<dest-ip>:1620|code-block|syntax|javascript|356896|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Assuming you know which machine you are sending to:

<pre><code>iptables -t nat -A OUTPUT -p udp --dport 162 -j DNAT --to-destination &lt;dest-ip&gt;:1620
</code></pre>

blocks|key|3358583|text|您可以设置一个转移规则，然后使用修改后的端口重新注入数据包。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3358584|我曾经在Mac上这样做过一段时间，但在Linux上也是如此：http://blog.dv8.ro/2006/08/using-divert-sockets-on-mac-os-x.html|offset|length|3358585|您基本上需要创建一个非常简单的透明代理。|3358586|entityMap|0|LINK|mutability|MUTABLE|url|http://blog.dv8.ro/2006/08/using-divert-sockets-on-mac-os-x.html^0|0|U|1S|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

You could set up a divert rule and then re-inject the packet with the modified port.

I've done this a while back on Mac OS X but it's the same principle on Linux:
<a href="http://blog.dv8.ro/2006/08/using-divert-sockets-on-mac-os-x.html" rel="nofollow noreferrer">http://blog.dv8.ro/2006/08/using-divert-sockets-on-mac-os-x.html</a>

You basically need to create a very simple transparent proxy.

blocks|key|359112|text|这种用法显然不受支持。摘自http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.txt|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|359113|359114|+6.3.7。更改本地生成的连接的目标|blockquote|359115|359116|NAT代码允许您在输出链中插入DNAT规则，但是|359117|这在2.4中不是完全支持的(它可以是，但它需要一个新的|359118|配置选项，一些测试，以及相当多的代码，所以除非有人签约Rusty来编写它，否则我不会期待它很快出现)。|359119|当前的限制是，您只能将目的地更改为|359120|本地计算机(例如，`j+DNAT+--到127.0.0.1')，而不是到任何其他计算机，否则回复将无法正确翻译。|359121|entityMap|0|LINK|mutability|MUTABLE|url|http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.txt^0|D|1M|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|D|3|-4|5|6|7|14|8|@]|9|@]|C|$]]|$1|E|3|F|5|G|7|15|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|16|8|@]|9|@]|C|$]]|$1|I|3|J|5|6|7|17|8|@]|9|@]|C|$]]|$1|K|3|L|5|6|7|18|8|@]|9|@]|C|$]]|$1|M|3|N|5|6|7|19|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|1A|8|@]|9|@]|C|$]]|$1|Q|3|R|5|6|7|1B|8|@]|9|@]|C|$]]|$1|S|3|-4|5|6|7|1C|8|@]|9|@]|C|$]]]|T|$U|$5|V|W|X|C|$Y|Z]]]]

This usage is apparently not supported. Taken from <a href="http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.txt" rel="nofollow noreferrer">http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.txt</a>:

<blockquote>
 6.3.7. Altering the Destination of Locally-Generated Connections
 
 The NAT code allows you to insert
 DNAT rules in the OUTPUT chain, but 
 this is not fully supported in 2.4 (it
 can be, but it requires a new 
 configuration option, some testing,
 and a fair bit of coding, so unless
 someone contracts Rusty to write it, I
 wouldn't expect it soon).
 
 The current limitation is that you
 can only change the destination to 
 the local machine (e.g. `j DNAT --to
 127.0.0.1'), not to any other machine, otherwise the replies won't
 be translated correctly.
</blockquote>

blocks|key|3358702|text|您可以将162重定向到1620|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3358703|iptables+-t+nat+-A+PREROUTING+-p+UDP+--dport+162+-j+REDIRECT+--to-port+1620|code-block|syntax|javascript|3358704|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

you could redirect 162 to 1620

<pre><code>iptables -t nat -A PREROUTING -p UDP --dport 162 -j REDIRECT --to-port 1620
</code></pre>

Is it possible to change the destination port of a UDP packet using iptables?

I'm trying to get an SNMP agent to send out traps on 1620 instead of 162. Unfortunately so far I've only managed to change the source port:

<blockquote>
 iptables -t nat -A POSTROUTING -p udp
 --dport 162 -j SNAT --to :1620
</blockquote>

Using iptables to change a destination port

Linux

是否可以使用iptables更改UDP数据包的目的端口？我正在尝试让SNMP代理在1620而不是162上发送陷阱。不幸的是，到目前为止，我只设法更改了源端口： iptables -t nat -A POSTROUTING -p udp --dport 162 -j SNAT --to :1620

问使用iptables更改目的端口
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用iptables更改目的端口EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用iptables更改目的端口
EN