Home/Server & Website Managed Operations/How to Configure Port Mapping (DNAT) on Alibaba Cloud Servers
Server & Website Managed Operations

How to Configure Port Mapping (DNAT) on Alibaba Cloud Servers

Published 2015-08-15By adminCategory Server & Website Managed Operations10 min read

Configuring DNAT via iptables is a common operation. While Alibaba Cloud servers in the Classic Network do not support SNAT, the DNAT functionality works correctly. Below are the steps for the method commonly used in our studio:

  Environment: Two Alibaba Cloud ECS servers—one with a public IP and one with an internal IP. Nginx is installed on the internal server, and we want to access the internal Nginx site when visiting the public server.
 
  The following steps are performed on the internal server:

First, install and start Nginx:

1 [root@Internal ~]# yum install nginx -y >>/dev/null
2 [root@Internal ~]# /etc/init.d/nginx start
3 Starting nginx: [ OK ]
4 [root@Internal ~]# lsof -i:80
5 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
6 nginx 1742 root 6u IPv4 5570 0t0 TCP *:http (LISTEN)

Test that Nginx is installed correctly and accessible:

1 [root@Internal ~]# curl -I www.yunwei123.com
2 HTTP/1.1 200 OK
3 Server: nginx/0.8.55
4 Date: Wed, 14 Jan 2015 07:29:05 GMT
5 Content-Type: text/html
6 Content-Length: 3698
7 Last-Modified: Tue, 11 Nov 2014 16:30:06 GMT
8 Connection: keep-alive
9 Accept-Ranges: bytes 
Perform the following operations on the public server:

 First, modify kernel parameters to enable IP forwarding.
1 [root@Public ~]# sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
2 Apply changes
3 [root@Public ~]# sysctl -p
4 net.ipv4.ip_forward = 1

Configure iptables to forward requests arriving at port 80 of the public server to port 80 of the internal server:

1 [root@Public ~]# iptables -t nat -I PREROUTING -d 115.29.96.246 -p tcp --dport 80 -j DNAT --to 10.144.26.11:80

Now, test by accessing the public server’s IP and capture packets to observe the forwarded traffic:

1 15:35:46.602240 IP 42.120.74.108.8864 > 115.29.96.246.80: S 765781831:765781831(0) win 8192
2 15:35:46.602272 IP 42.120.74.108.8864 > 10.144.26.11.80: S 765781831:765781831(0) win 8192

At this point, the source address is the visitor’s public IP, and the destination is the internal server’s private IP. This prevents two-way communication. Therefore, we need to change the source address of these packets to an internal address so that communication with the internal server can be established. Changing the source address involves SNAT.
We continue configuring on the public server:

1 [root@Public ~]# iptables -t nat -I POSTROUTING -d 10.144.26.11 -p tcp --dport 80 -j SNAT --to 10.163.209.59

Packet capture analysis:

1 15:38:14.846955 IP 42.120.74.108.10839 > 115.29.96.246.80: P 433:858(425) ack 159 win 16385
2 15:38:14.846985 IP 10.163.209.59.10839 > 10.144.26.11.80: P 433:858(425) ack 159 win 16385
3 15:38:14.847759 IP 10.144.26.11.80 > 10.163.209.59.10839: P 159:317(158) ack 858 win 317
4 15:38:14.847772 IP 115.29.96.246.80 > 42.120.74.108.10839: P 159:317(158) ack 858 win 317

Visitor’s local public IP -> Public Server’s Public IP
Destination address modified
Public Server’s Internal IP -> Internal Server’s IP
Source address modified
Internal Server’s IP -> Public Server’s Internal IP
Public Server’s Public IP -> Visitor’s local public IP

Communication completed. Give it a try.

Related Reading

RELATED

Related notes

502 / 503 / 504: Root Causes, Diagnosis, and Fixes

These three status codes are o…

Read more

Identifying DDoS and CC Attacks: From Connection Counts, Logs to Emergency Rate Limiting

When a website suddenly become…

Read more

Public Security Filing vs. ICP Filing: Differences and Application Order

Many people mistakenly believe…

Read more
FREE CHECKUP

Free server checkup

We will send a problem checklist and remediation advice within one business day — no obligation to engage.

135 410 16684
Weekdays Mon – Fri 10:00 – 22:00 (UTC+8)　·　7×24 emergency response
Call now
CONTACT

Contact Us

How can we help?

* Required