Nftables nat: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| (2 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 1: | Zeile 1: | ||
=DNAT zum client= | =DNAT zum client= | ||
| + | ;Rausfinden der MAC Adresse | ||
| + | *tail -f /var/lib/kea/kea-leases4.csv | ||
| + | 172.26.213.50,08:00:27:e8:73:76,01:'''08:00:27:e8:73:76''',7200,1785495333,1,0,0,client,0,,0 | ||
| + | |||
;Zuerst dem Client über dhcp eine feste IP zu teilen | ;Zuerst dem Client über dhcp eine feste IP zu teilen | ||
*cat /etc/kea/kea-dhcp4.conf | *cat /etc/kea/kea-dhcp4.conf | ||
{ "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.2XX.10", "hostname": "client" } | { "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.2XX.10", "hostname": "client" } | ||
| + | ersetzen | ||
| + | { "hw-address": "08:00:27:e8:73:76", "ip-address": "172.26.2XX.10", "hostname": "client" } | ||
| + | |||
;Neustart nicht vergessen | ;Neustart nicht vergessen | ||
*systemctl restart kea-dhcp4-server.service | *systemctl restart kea-dhcp4-server.service | ||
| Zeile 28: | Zeile 35: | ||
<span style="color:#FF0000">chain prerouting {</span> | <span style="color:#FF0000">chain prerouting {</span> | ||
<span style="color:#FF0000">type nat hook prerouting priority dstnat; policy accept;</span> | <span style="color:#FF0000">type nat hook prerouting priority dstnat; policy accept;</span> | ||
| − | <span style="color:#FF0000">ip daddr $ | + | <span style="color:#FF0000">ip daddr $WANIP tcp dport 9922 dnat ip to $CLIENT:22</span> |
<span style="color:#FF0000">}</span> | <span style="color:#FF0000">}</span> | ||
Aktuelle Version vom 3. August 2026, 06:25 Uhr
DNAT zum client
- Rausfinden der MAC Adresse
- tail -f /var/lib/kea/kea-leases4.csv
172.26.213.50,08:00:27:e8:73:76,01:08:00:27:e8:73:76,7200,1785495333,1,0,0,client,0,,0
- Zuerst dem Client über dhcp eine feste IP zu teilen
- cat /etc/kea/kea-dhcp4.conf
{ "hw-address": "aa:bb:cc:dd:ee:ff", "ip-address": "172.26.2XX.10", "hostname": "client" }
ersetzen
{ "hw-address": "08:00:27:e8:73:76", "ip-address": "172.26.2XX.10", "hostname": "client" }
- Neustart nicht vergessen
- systemctl restart kea-dhcp4-server.service
- Man soll über den port 9922 und der äusseren Ip der Firewall per ssh auf den Client auf Port 22 zugreifen
define CLIENT = 172.26.2XX.10 table inet filter { .... chain forward { type filter hook forward priority filter; policy drop; ct state established,related accept ... ct state new iif $WANDEV oif $LANDEV ip daddr $CLIENT tcp dport 22 accept log prefix "--nftables-drop-forward--" }
table inet nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
ip daddr $WANIP tcp dport 9922 dnat ip to $CLIENT:22
}