用nat outbound和nat server 实现内网用公网ip访问内部服务器
1.组网
2.需求
不使用nat hairpin,通过做nat server和nat outbound来实现在内网通过公网地址访问内部服务器。
3.关键配置
#
interface GigabitEthernet0/0
port link-mode route
ip address 192.168.1.1 255.255.255.0
//终端和服务器在同一网段的时候必须要做源地址转换（不然服务器回包不会到路由器上面匹配nat会话做反向地址转换，而是直接回给终端，由于回给终端的报文的源地址是服务器的内网地址，终端不认，从而无法访问）
nat outbound 3000
nat server protocol tcp global 1.1.1.1 23 inside 192.168.1.10 23
#
interface GigabitEthernet0/1
port link-mode route
ip address 192.168.2.1 255.255.255.0
//终端和服务器不在同一网段的时候可以不做源地址转换
nat server protocol tcp global 1.1.1.1 23 inside 192.168.1.10 23
#
interface GigabitEthernet0/2
port link-mode route
description WAN
combo enable copper
ip address 1.1.1.1 255.255.255.0
nat outbound
nat server protocol tcp global 1.1.1.1 23 inside 192.168.1.10 23
#
acl advanced 3000
rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.1.10 0
#
return
4.测试
PC4访问1.1.1.1 23
<PC4>telnet 1.1.1.1
Trying 1.1.1.1 ...
Press CTRL+K to abort
Connected to 1.1.1.1 ...
******************************************************************************
* Copyright (c) 2004-2017 New H3C Technologies Co., Ltd. All rights reserved.*
* Without the owner's prior written consent, *
* no decompiling or reverse-engineering shall be allowed. *
******************************************************************************
login: admin
Password:
<server5>
R1上debug nat paket信息如下：
[R1]*Jun 23 08:06:23:271 2020 R1 NAT/7/COMMON:
//入方向先匹配nat server做目的IP地址转换
PACKET: (GigabitEthernet0/0-in) Protocol: TCP
192.168.1.2:16328 - 1.1.1.1: 23(VPN: 0) ------>
192.168.1.2:16328 - 192.168.1.10: 23(VPN: 0)
*Jun 23 08:06:23:271 2020 R1 NAT/7/COMMON:
//出方向匹配nat outbound做源IP地址转换
PACKET: (GigabitEthernet0/0-out) Protocol: TCP
192.168.1.2:16328 - 192.168.1.10: 23(VPN: 0) ------>
192.168.1.1: 1031 - 192.168.1.10: 23(VPN: 0)
*Jun 23 08:06:23:272 2020 R1 NAT/7/COMMON:
//服务器回包入方向匹配会话做目的ip地址抓换
PACKET: (GigabitEthernet0/0-in) Protocol: TCP
192.168.1.10: 23 - 192.168.1.1: 1031(VPN: 0) ------>
192.168.1.10: 23 - 192.168.1.2:16328(VPN: 0)
*Jun 23 08:06:23:272 2020 R1 NAT/7/COMMON:
//服务器回包出方向匹配会话做源ip地址抓换
PACKET: (GigabitEthernet0/0-out) Protocol: TCP
192.168.1.10: 23 - 192.168.1.2:16328(VPN: 0) ------>
1.1.1.1: 23 - 192.168.1.2:16328(VPN: 0)
PC6访问 1.1.1.1 23
<PC6>telnet 1.1.1.1
Trying 1.1.1.1 ...
Press CTRL+K to abort
Connected to 1.1.1.1 ...
******************************************************************************
* Copyright (c) 2004-2017 New H3C Technologies Co., Ltd. All rights reserved.*
* Without the owner's prior written consent, *
* no decompiling or reverse-engineering shall be allowed. *
******************************************************************************
login: admin
Password:
<server5>
R1上debug nat paket信息如下：
（转换原理与上面类似，不再赘述）
[R1]*Jun 23 08:11:10:286 2020 R1 NAT/7/COMMON:
PACKET: (GigabitEthernet0/1-in) Protocol: TCP
192.168.2.2:31361 - 1.1.1.1: 23(VPN: 0) ------>
192.168.2.2:31361 - 192.168.1.10: 23(VPN: 0)
*Jun 23 08:11:10:288 2020 R1 NAT/7/COMMON:
PACKET: (GigabitEthernet0/1-out) Protocol: TCP
192.168.1.10: 23 - 192.168.2.2:31361(VPN: 0) ------>
1.1.1.1: 23 - 192.168.2.2:31361(VPN: 0)