转:http://blog.csdn.net/eastonwoo/article/details/12975821

      端口映射,包括本地端口映射和远程端口映射.本文介绍两种可行的办法:iptables 和 ssh.下面我们来介绍这两种方法的使用方式. 

本地主机IP A:192.168.1.119 

远程主机IP B:192.168.1.120 

方法

1:ssh 方式:

     -N      不执行远程命令. 用于转发端口. (仅限协议第二版)

     -L port:host:hostport
             将本地机(客户机)的某个端口转发到远端指定机器的指定端口.  工作原理是这样的, 本地机器上分配了一个 socket 侦听
             port 端口, 一旦这个端口上有了连接, 该连接就经过安全通道转发出去, 同时远程主机和 host 的 hostport 端口建立连接.
             可以在配置文件中指定端口的转发. 只有 root 才能转发特权端口.  IPv6 地址用另一种格式说明: port/host/hostport

     -R port:host:hostport
             将远程主机(服务器)的某个端口转发到本地端指定机器的指定端口.  工作原理是这样的, 远程主机上分配了一个 socket 侦听
             port 端口, 一旦这个端口上有了连接, 该连接就经过安全通道转向出去, 同时本地主机和 host 的 hostport 端口建立连接.
             可以在配置文件中指定端口的转发. 只有用 root 登录远程主机 才能转发特权端口. IPv6 地址用另一种格式说明:
             port/host/hostport 

1.1: 使用-R参数:

       远程映射: ssh -N -R 9876:127.0.0.1:22192.168.1.120 , 意思将远程主机port(9876)端口映射到本地主机host(192.168.1.119)的本地端口hostport(22)上面.192.168.1.120是输这个命令时访问的远程主机. 因为远程主机侦听9876端口,所以远程主机访问9876端口就相当于访问192.168.1.119的22端口了.

      测试结果:

A(119):

[root:user] ssh -N -R 9876:127.0.0.1:22 192.168.1.120
root@192.168.1.120's password:                    

B(120):         

<user:work> ssh 127.0.0.1 -p 9876
user@127.0.0.1's password: 
Linux debian 3.2.0-3-686-pae #1 SMP Thu Jun 28 08:56:46 UTC 2012 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 23 19:12:53 2013 from debian.local
[user:~] ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:e4:81:9d  
          inet addr:192.168.1.119  Bcast:192.168.255.255  Mask:255.255.0.0                #120已经成功访问到119机器
          inet6 addr: fe80::a00:27ff:fee4:819d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2527825 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2946303 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1142752654 (1.0 GiB)  TX bytes:3537921035 (3.2 GiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:3658 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3658 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:492528 (480.9 KiB)  TX bytes:492528 (480.9 KiB)

[user:~]  

       本地映射: 同理 :  ssh -N -R 9876:127.0.0.1:22127.0.0.1, 意思将远程主机port(9876)端口映射到本地主机host(192.168.1.119)的本地端口hostport(22)上面.127.0.0.1是输这个命令时访问的远程主机(实际上用的是本机IP).

      测试结果:

A(119):

[root:user] ssh -N -R 9876:127.0.0.1:22 127.0.0.1
root@127.0.0.1's password: 

A(120)

[user:work] ssh 127.0.0.1 -p 9876
ssh: connect to host 127.0.0.1 port 9876: Connection refused
[user:work] ssh 127.0.0.1 -p 9876
Linux debian 3.2.0-3-686-pae #1 SMP Thu Jun 28 08:56:46 UTC 2012 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 23 19:29:00 2013 from localhost
[user:~]                                            #已经成功登陆到shell,从/work目录进入到了user的根用户目录 

1.2: 使用-L参数:

       远程映射: ssh -N -L 9876:192.168.1.120:22127.0.0.1, 意思将本地主机port(9876)端口映射到远程主机host(192.168.1.120)的远程端口hostport(22)上面.192.168.1.119是输这个命令时捆定的本地主机. 因为本地主机侦听9876端口,所以本地主机访问9876端口就相当于访问192.168.1.120的22端口了.

      测试结果:

A(119):

[root:user] ssh -N -L 9876:192.168.1.120:22 127.0.0.1
root@127.0.0.1's password: 

A(119):

[user:~] ssh 127.0.0.1 -p 9876
user@127.0.0.1's password: 
Linux debian 3.2.0-3-686-pae #1 SMP Thu Jun 28 08:56:46 UTC 2012 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 23 19:45:30 2013 from debian.local
<user:~> ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:e4:81:9d  
          inet addr:192.168.1.120  Bcast:192.168.255.255  Mask:255.255.0.0     #119已经成功访问到120机器
          inet6 addr: fe80::a00:27ff:fee4:819d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:13528 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1731 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1304332 (1.2 MiB)  TX bytes:331565 (323.7 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:774 errors:0 dropped:0 overruns:0 frame:0
          TX packets:774 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:104032 (101.5 KiB)  TX bytes:104032 (101.5 KiB)

<user:~> 

       本地映射: 同理,也就不多说了,大家可以自己尝试一下. 

2:iptables 方式: 

将与 9876 端口的 TCP 连接转接到本地的 22端口上。使用 DNAT (Destination Network Address Translation) 技术可以满足这一要求。

因为 iptables 在处理本地连接和远程连接的方法不同，所以需要分开处理。

2.1:远程连接

远程连接指的是由另外一台机器连接到这台机器上。这种连接的数据包在 iptables 会首先经过 PREROUTING 链，所以只需在 PREROUTING 链中作 DNAT。
# iptables -t nat -A PREROUTING -p tcp -i eth0 -d 192.168.1.119 --dport 9876 -j DNAT --to 192.168.1.120:22

2.2:本地连接

本地连接指的是在本机上，用 127.0.0.1 或者本机 IP 来访问本机的端口。本地连接的数据包不会通过网卡，而是由内核处理后直接发给本地进程。这种数据包在 iptables 中只经过 OUTPUT 链，而不会经过 PREROUTING 链。所以需要在 OUTPUT 链中进行 DNAT。除了对127.0.0.1 之外，对本机 IP (即192.168.1.119) 的访问也属于本地连接。
# iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 9876 -j DNAT --to 127.0.0.1:22

# iptables -t nat -A OUTPUT -p tcp -d 192.168.1.119 --dport 9876 -j DNAT --to 127.0.0.1:22 

测试结果:

A(119):

[root:src] 
[root:src] iptables -L  -t nat -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
[root:src] iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 9876 -j DNAT --to 127.0.0.1:22
[root:src] iptables -t nat -A OUTPUT -p tcp -d 192.168.1.119 --dport 9876 -j DNAT --to 127.0.0.1:22
[root:src] iptables -L  -t nat -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  0.0.0.0/0            127.0.0.1            tcp dpt:9876 to:127.0.0.1:22
DNAT       tcp  --  0.0.0.0/0            192.168.1.119        tcp dpt:9876 to:127.0.0.1:22

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
[root:src] 

A(119):

[user:src] 
[user:src] ssh 192.168.1.119 -p 9876
Linux debian 3.2.0-3-686-pae #1 SMP Thu Jun 28 08:56:46 UTC 2012 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 23 19:33:43 2013 from localhost
[user:~] 登出
Connection to 192.168.1.119 closed.
[user:src] ssh 127.0.0.1 -p 9876
Linux debian 3.2.0-3-686-pae #1 SMP Thu Jun 28 08:56:46 UTC 2012 i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 23 20:12:54 2013 from debian.local
[user:~] 登出
Connection to 127.0.0.1 closed.
[user:src]

如有问题，可以QQ搜索群1028468525加入群聊，欢迎一起研究技术

有疑问联系站长，请联系QQ：