How to Configure Port Mapping (DNAT) on Alibaba Cloud Servers

Configuring DNAT via iptables is a common operation. While Alibaba Cloud servers in the Classic Network do not support SNAT, the DNAT functionality works correctly. Below are the steps for the method commonly used in our studio:

  Environment: Two Alibaba Cloud ECS servers—one with a public IP and one with an internal IP. Nginx is installed on the internal server, and we want to access the internal Nginx site when visiting the public server.
 
  The following steps are performed on the internal server:

First, install and start Nginx:

Test that Nginx is installed correctly and accessible:

Perform the following operations on the public server:

 First, modify kernel parameters to enable IP forwarding.

Configure iptables to forward requests arriving at port 80 of the public server to port 80 of the internal server:

Now, test by accessing the public server’s IP and capture packets to observe the forwarded traffic:

At this point, the source address is the visitor’s public IP, and the destination is the internal server’s private IP. This prevents two-way communication. Therefore, we need to change the source address of these packets to an internal address so that communication with the internal server can be established. Changing the source address involves SNAT.
We continue configuring on the public server:

Packet capture analysis:

Visitor’s local public IP -> Public Server’s Public IP
Destination address modified
Public Server’s Internal IP -> Internal Server’s IP
Source address modified
Internal Server’s IP -> Public Server’s Internal IP
Public Server’s Public IP -> Visitor’s local public IP

Communication completed. Give it a try.