Configuring DNAT via iptables is a common operation. While Alibaba Cloud servers in the classic network do not support SNAT, DNAT works perfectly fine. Here is a summary of the operational process:
Experimental Environment: Two Alibaba Cloud ECS instances—one with a public IP and one with an internal IP. Nginx is installed on the internal server, and the goal is to access the internal Nginx site when visiting the public server.
Internal Server Operations
First, install and start Nginx:
[root@internal ~]# yum install nginx -y >>/dev/null [root@internal ~]# /etc/init.d/nginx start Starting nginx: [ OK ] [root@internal ~]# lsof -i:80 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME nginx 1742 root 6u IPv4 5570 0t0 TCP *:http (LISTEN)
Test that Nginx is installed correctly and accessible:
[root@internal ~]# curl -I localhost HTTP/1.1 200 OK Server: nginx/0.8.55 Date: Wed, 14 Jan 2015 07:29:05 GMT Content-Type: text/html Content-Length: 3698 Last-Modified: Tue, 11 Nov 2014 16:30:06 GMT Connection: keep-alive Accept-Ranges: bytes
Public Server Operations
First, modify kernel parameters to enable IP forwarding:
[root@public ~]# sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
Apply the changes:
[root@public ~]# sysctl -p net.ipv4.ip_forward = 1
Configure iptables to forward requests arriving at port 80 on the public server to port 80 on the internal server:
[root@public ~]# iptables -t nat -I PREROUTING -d 115.29.96.246 -p tcp --dport 80 -j DNAT --to 10.144.26.11:80
Now, test by accessing the public server’s IP and capture packets to observe the forwarded traffic:
15:35:46.602240 IP 42.120.74.108.8864 > 115.29.96.246.80: S 765781831:765781831(0) win 8192 15:35:46.602272 IP 42.120.74.108.8864 > 10.144.26.11.80: S 765781831:765781831(0) win 8192
As you can see, the source address is the visitor’s public IP, and the destination is the internal server’s private IP. This setup does not allow for two-way communication. Therefore, we need to change the source address of these packets to an internal address so that communication with the internal server can be established.
Changing the source address involves SNAT. Continue configuring on the public server:
[root@public ~]# iptables -t nat -I POSTROUTING -d 10.144.26.11 -p tcp --dport 80 -j SNAT --to 10.163.209.59
Analyze the packet capture:
15:38:14.846955 IP 42.120.74.108.10839 > 115.29.96.246.80: P 433:858(425) ack 159 win 16385 15:38:14.846985 IP 10.163.209.59.10839 > 10.144.26.11.80: P 433:858(425) ack 159 win 16385 15:38:14.847759 IP 10.144.26.11.80 > 10.163.209.59.10839: P 159:317(158) ack 858 win 317 15:38:14.847772 IP 115.29.96.246.80 > 42.120.74.108.10839: P 159:317(158) ack 858 win 317
- Visitor’s local public IP → Public server’s public IP (Destination address modified)
- Public server’s internal IP → Internal server’s IP (Source address modified)
- Internal server’s IP → Public server’s internal IP
- Public server’s public IP → Visitor’s local public IP
Communication is now complete. Give it a try.