Linux下端口轉(zhuǎn)發(fā)的三種常見方案及對比詳解
更新時間：2025年11月17日 10:18:41 作者：LCG元
端口轉(zhuǎn)發(fā)是一種將網(wǎng)絡(luò)數(shù)據(jù)包從一個網(wǎng)絡(luò)端口重定向到另一個端口或主機(jī)的技術(shù),在Linux環(huán)境中,端口轉(zhuǎn)發(fā)常用于安全訪問、服務(wù)暴露、網(wǎng)絡(luò)調(diào)試等場景,本文將詳細(xì)探討三種常見的端口轉(zhuǎn)發(fā)方案,分析各自的優(yōu)缺點,并提供完整的配置示例,需要的朋友可以參考下
1. 端口轉(zhuǎn)發(fā)概述
端口轉(zhuǎn)發(fā)（Port Forwarding）是一種將網(wǎng)絡(luò)數(shù)據(jù)包從一個網(wǎng)絡(luò)端口重定向到另一個端口或主機(jī)的技術(shù)。在Linux環(huán)境中，端口轉(zhuǎn)發(fā)常用于安全訪問、服務(wù)暴露、網(wǎng)絡(luò)調(diào)試等場景。本文將詳細(xì)探討三種常見的端口轉(zhuǎn)發(fā)方案：SSH、socat和iptables，分析各自的優(yōu)缺點，并提供完整的配置示例。
2. 環(huán)境準(zhǔn)備與基礎(chǔ)概念
2.1 測試環(huán)境搭建
在開始配置之前，我們需要準(zhǔn)備測試環(huán)境：
# 創(chuàng)建測試目錄 mkdir -p ~/port_forwarding_demo cd ~/port_forwarding_demo # 安裝必要工具（基于Ubuntu/Debian） sudo apt update sudo apt install -y openssh-client openssh-server socat net-tools iptables-persistent netcat # 驗證工具安裝 ssh -V socat -version iptables --version
2.2 網(wǎng)絡(luò)拓?fù)湔f明
在本文的示例中，我們將使用以下網(wǎng)絡(luò)配置：
- 本地主機(jī)：127.0.0.1 (localhost)
- 目標(biāo)服務(wù)：運行在8080端口的Web服務(wù)
- 中轉(zhuǎn)端口：9000（用于轉(zhuǎn)發(fā)）
- 遠(yuǎn)程主機(jī)：192.168.1.100（在實際使用時替換為你的遠(yuǎn)程服務(wù)器IP）
3. SSH端口轉(zhuǎn)發(fā)方案
3.1 SSH端口轉(zhuǎn)發(fā)原理
SSH端口轉(zhuǎn)發(fā)利用SSH協(xié)議的安全隧道功能，在客戶端和服務(wù)器之間建立加密通道。數(shù)據(jù)流向如下：
3.2 本地端口轉(zhuǎn)發(fā)
本地端口轉(zhuǎn)發(fā)將本地端口的流量通過SSH隧道轉(zhuǎn)發(fā)到遠(yuǎn)程服務(wù)器。
創(chuàng)建配置文件：local_forward.sh
#!/bin/bash
# local_forward.sh - SSH本地端口轉(zhuǎn)發(fā)示例
# 配置參數(shù)
REMOTE_USER="your_username"
REMOTE_HOST="192.168.1.100"
REMOTE_PORT="8080"
LOCAL_PORT="9000"
SSH_PORT="22"
echo "正在設(shè)置SSH本地端口轉(zhuǎn)發(fā)..."
echo "將本地端口 ${LOCAL_PORT} 轉(zhuǎn)發(fā)到 ${REMOTE_HOST}:${REMOTE_PORT}"
# 檢查SSH密鑰是否存在，如果不存在則生成
if [ ! -f ~/.ssh/id_rsa ]; then
echo "生成SSH密鑰對..."
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""
echo "請將公鑰復(fù)制到遠(yuǎn)程服務(wù)器："
echo "ssh-copy-id ${REMOTE_USER}@${REMOTE_HOST}"
fi
# 執(zhí)行端口轉(zhuǎn)發(fā)命令
echo "啟動SSH端口轉(zhuǎn)發(fā)，按Ctrl+C終止"
ssh -N -L ${LOCAL_PORT}:127.0.0.1:${REMOTE_PORT} ${REMOTE_USER}@${REMOTE_HOST} -p ${SSH_PORT}
# 如果連接失敗，提示用戶
if [ $? -ne 0 ]; then
echo "SSH連接失敗，請檢查："
echo "1. 遠(yuǎn)程服務(wù)器地址和用戶名是否正確"
echo "2. SSH服務(wù)是否在遠(yuǎn)程服務(wù)器上運行"
echo "3. 防火墻設(shè)置是否允許SSH連接"
echo "4. 是否已經(jīng)將SSH公鑰添加到遠(yuǎn)程服務(wù)器"
fi
使用方法：
# 給腳本執(zhí)行權(quán)限 chmod +x local_forward.sh # 執(zhí)行端口轉(zhuǎn)發(fā) ./local_forward.sh
3.3 遠(yuǎn)程端口轉(zhuǎn)發(fā)
遠(yuǎn)程端口轉(zhuǎn)發(fā)將遠(yuǎn)程服務(wù)器端口的流量轉(zhuǎn)發(fā)到本地服務(wù)。
創(chuàng)建配置文件：remote_forward.sh
#!/bin/bash
# remote_forward.sh - SSH遠(yuǎn)程端口轉(zhuǎn)發(fā)示例
# 配置參數(shù)
REMOTE_USER="your_username"
REMOTE_HOST="192.168.1.100"
REMOTE_PORT="9000"
LOCAL_PORT="8080"
LOCAL_HOST="127.0.0.1"
SSH_PORT="22"
echo "正在設(shè)置SSH遠(yuǎn)程端口轉(zhuǎn)發(fā)..."
echo "將遠(yuǎn)程服務(wù)器 ${REMOTE_HOST} 的端口 ${REMOTE_PORT} 轉(zhuǎn)發(fā)到本地 ${LOCAL_HOST}:${LOCAL_PORT}"
# 檢查本地服務(wù)是否運行
if ! nc -z ${LOCAL_HOST} ${LOCAL_PORT} 2>/dev/null; then
echo "警告：本地服務(wù) ${LOCAL_HOST}:${LOCAL_PORT} 可能沒有運行"
echo "請確保在繼續(xù)之前啟動本地服務(wù)"
read -p "是否繼續(xù)？(y/n): " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
exit 1
fi
fi
# 執(zhí)行遠(yuǎn)程端口轉(zhuǎn)發(fā)
echo "啟動SSH遠(yuǎn)程端口轉(zhuǎn)發(fā)，按Ctrl+C終止"
ssh -N -R ${REMOTE_PORT}:${LOCAL_HOST}:${LOCAL_PORT} ${REMOTE_USER}@${REMOTE_HOST} -p ${SSH_PORT}
if [ $? -ne 0 ]; then
echo "SSH遠(yuǎn)程端口轉(zhuǎn)發(fā)失敗"
echo "請檢查："
echo "1. 遠(yuǎn)程服務(wù)器的SSH配置是否允許遠(yuǎn)程端口轉(zhuǎn)發(fā)（GatewayPorts選項）"
echo "2. 遠(yuǎn)程服務(wù)器防火墻設(shè)置"
fi
3.4 動態(tài)端口轉(zhuǎn)發(fā)
動態(tài)端口轉(zhuǎn)發(fā)創(chuàng)建SOCKS代理服務(wù)器。
創(chuàng)建配置文件：dynamic_forward.sh
#!/bin/bash
# dynamic_forward.sh - SSH動態(tài)端口轉(zhuǎn)發(fā)示例
# 配置參數(shù)
REMOTE_USER="your_username"
REMOTE_HOST="192.168.1.100"
SOCKS_PORT="1080"
SSH_PORT="22"
echo "正在設(shè)置SSH動態(tài)端口轉(zhuǎn)發(fā)(SOCKS代理)..."
echo "SOCKS代理將在本地端口 ${SOCKS_PORT} 啟動"
# 啟動動態(tài)端口轉(zhuǎn)發(fā)
echo "啟動SOCKS代理服務(wù)器，按Ctrl+C終止"
ssh -N -D 127.0.0.1:${SOCKS_PORT} ${REMOTE_USER}@${REMOTE_HOST} -p ${SSH_PORT}
echo "SOCKS代理已停止"
echo "配置瀏覽器或其他應(yīng)用使用SOCKS代理：127.0.0.1:${SOCKS_PORT}"
3.5 SSH端口轉(zhuǎn)發(fā)高級配置
創(chuàng)建配置文件：ssh_advanced.sh
#!/bin/bash
# ssh_advanced.sh - SSH高級端口轉(zhuǎn)發(fā)配置
# 配置參數(shù)
REMOTE_USER="your_username"
REMOTE_HOST="192.168.1.100"
SSH_PORT="22"
CONFIG_FILE="$HOME/ssh_forward_config"
# 寫入SSH客戶端配置
cat > ${CONFIG_FILE} << EOF
# SSH端口轉(zhuǎn)發(fā)配置
Host forward-server
HostName ${REMOTE_HOST}
User ${REMOTE_USER}
Port ${SSH_PORT}
ServerAliveInterval 60
ServerAliveCountMax 3
Compression yes
ExitOnForwardFailure yes
LocalForward 9000 127.0.0.1:8080
RemoteForward 9001 127.0.0.1:3000
# 自動重連配置
Host auto-reconnect
HostName ${REMOTE_HOST}
User ${REMOTE_USER}
Port ${SSH_PORT}
ServerAliveInterval 30
ServerAliveCountMax 10
TCPKeepAlive yes
ExitOnForwardFailure yes
EOF
echo "SSH配置文件已生成: ${CONFIG_FILE}"
echo "使用方法:"
echo "1. 本地轉(zhuǎn)發(fā): ssh -L 9000:localhost:8080 ${REMOTE_USER}@${REMOTE_HOST}"
echo "2. 遠(yuǎn)程轉(zhuǎn)發(fā): ssh -R 9001:localhost:3000 ${REMOTE_USER}@${REMOTE_HOST}"
echo "3. 使用配置文件: ssh -F ${CONFIG_FILE} forward-server"
4. socat端口轉(zhuǎn)發(fā)方案
4.1 socat工作原理
socat是一個多功能的網(wǎng)絡(luò)工具，可以在兩個數(shù)據(jù)流之間建立雙向通道。其數(shù)據(jù)流向如下：
4.2 基礎(chǔ)TCP端口轉(zhuǎn)發(fā)
創(chuàng)建配置文件：socat_basic.sh
#!/bin/bash
# socat_basic.sh - 基礎(chǔ)TCP端口轉(zhuǎn)發(fā)
LISTEN_PORT="9000"
TARGET_HOST="192.168.1.100"
TARGET_PORT="8080"
LOG_FILE="/tmp/socat_forward.log"
echo "啟動socat TCP端口轉(zhuǎn)發(fā)..."
echo "監(jiān)聽端口: ${LISTEN_PORT}"
echo "目標(biāo)地址: ${TARGET_HOST}:${TARGET_PORT}"
echo "日志文件: ${LOG_FILE}"
# 檢查目標(biāo)端口是否可達(dá)
echo "檢查目標(biāo)服務(wù)器連通性..."
if ! nc -z ${TARGET_HOST} ${TARGET_PORT} 2>/dev/null; then
echo "警告: 無法連接到目標(biāo)服務(wù)器 ${TARGET_HOST}:${TARGET_PORT}"
read -p "是否繼續(xù)？(y/n): " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
exit 1
fi
fi
# 創(chuàng)建日志目錄
mkdir -p $(dirname ${LOG_FILE})
echo "啟動時間: $(date)" >> ${LOG_FILE}
echo "啟動socat進(jìn)程..."
# 啟動socat端口轉(zhuǎn)發(fā)
socat -d -d -lf ${LOG_FILE} \
TCP-LISTEN:${LISTEN_PORT},fork,reuseaddr \
TCP:${TARGET_HOST}:${TARGET_PORT}
echo "socat進(jìn)程已停止"
echo "查看詳細(xì)日志: tail -f ${LOG_FILE}"
4.3 SSL/TLS加密轉(zhuǎn)發(fā)
創(chuàng)建配置文件：socat_ssl.sh
#!/bin/bash
# socat_ssl.sh - SSL/TLS加密端口轉(zhuǎn)發(fā)
LISTEN_PORT="9000"
TARGET_HOST="192.168.1.100"
TARGET_PORT="8080"
CERT_DIR="./ssl_certs"
KEY_FILE="${CERT_DIR}/server.key"
CERT_FILE="${CERT_DIR}/server.crt"
LOG_FILE="/tmp/socat_ssl.log"
echo "設(shè)置SSL/TLS加密端口轉(zhuǎn)發(fā)..."
# 創(chuàng)建SSL證書目錄
mkdir -p ${CERT_DIR}
# 生成自簽名SSL證書（如果不存在）
if [ ! -f ${KEY_FILE} ] || [ ! -f ${CERT_FILE} ]; then
echo "生成自簽名SSL證書..."
openssl req -x509 -newkey rsa:4096 -keyout ${KEY_FILE} \
-out ${CERT_FILE} -days 365 -nodes -subj \
"/C=US/ST=State/L=City/O=Organization/CN=localhost"
if [ $? -eq 0 ]; then
echo "SSL證書已生成:"
echo "密鑰文件: ${KEY_FILE}"
echo "證書文件: ${CERT_FILE}"
else
echo "SSL證書生成失敗"
exit 1
fi
fi
echo "啟動SSL加密轉(zhuǎn)發(fā)..."
echo "監(jiān)聽端口: ${LISTEN_PORT}"
echo "目標(biāo)地址: ${TARGET_HOST}:${TARGET_PORT}"
# 啟動SSL加密轉(zhuǎn)發(fā)
socat -d -d -lf ${LOG_FILE} \
openssl-listen:${LISTEN_PORT},fork,reuseaddr,cert=${CERT_FILE},key=${KEY_FILE},verify=0 \
TCP:${TARGET_HOST}:${TARGET_PORT}
echo "SSL轉(zhuǎn)發(fā)進(jìn)程已停止"
4.4 UDP端口轉(zhuǎn)發(fā)
創(chuàng)建配置文件：socat_udp.sh
#!/bin/bash
# socat_udp.sh - UDP端口轉(zhuǎn)發(fā)
LISTEN_PORT="9000"
TARGET_HOST="192.168.1.100"
TARGET_PORT="8080"
PROTOCOL="UDP"
echo "啟動${PROTOCOL}端口轉(zhuǎn)發(fā)..."
echo "監(jiān)聽端口: ${LISTEN_PORT}"
echo "目標(biāo)地址: ${TARGET_HOST}:${TARGET_PORT}"
# 檢查socat版本是否支持UDP
socat -h | grep -q "UDP4"
if [ $? -ne 0 ]; then
echo "警告: 當(dāng)前socat版本可能不完全支持UDP功能"
fi
echo "啟動UDP端口轉(zhuǎn)發(fā)進(jìn)程..."
# 啟動UDP轉(zhuǎn)發(fā)
socat -u UDP4-LISTEN:${LISTEN_PORT},fork,reuseaddr \
UDP4:${TARGET_HOST}:${TARGET_PORT} &
PID=$!
echo "UDP轉(zhuǎn)發(fā)進(jìn)程已啟動 (PID: ${PID})"
echo "按任意鍵停止轉(zhuǎn)發(fā)..."
read -n 1
kill ${PID}
echo "UDP轉(zhuǎn)發(fā)進(jìn)程已停止"
4.5 高級socat配置
創(chuàng)建配置文件：socat_advanced.sh
#!/bin/bash
# socat_advanced.sh - 高級socat配置
CONFIG_DIR="./socat_configs"
mkdir -p ${CONFIG_DIR}
# 創(chuàng)建多個轉(zhuǎn)發(fā)配置
cat > ${CONFIG_DIR}/web_forward.cfg << 'EOF'
# Web服務(wù)轉(zhuǎn)發(fā)配置
# 監(jiān)聽端口: 9080 -> 目標(biāo): 192.168.1.100:80
socat TCP-LISTEN:9080,fork,reuseaddr TCP:192.168.1.100:80
EOF
cat > ${CONFIG_DIR}/database_forward.cfg << 'EOF'
# 數(shù)據(jù)庫服務(wù)轉(zhuǎn)發(fā)配置
# 監(jiān)聽端口: 93306 -> 目標(biāo): 192.168.1.100:3306
socat TCP-LISTEN:93306,fork,reuseaddr TCP:192.168.1.100:3306
EOF
cat > ${CONFIG_DIR}/ssl_termination.cfg << 'EOF'
# SSL終止配置
# 外部SSL -> 內(nèi)部明文
socat OPENSSL-LISTEN:9443,fork,reuseaddr,cert=./ssl_certs/server.crt,key=./ssl_certs/server.key,verify=0 TCP:192.168.1.100:443
EOF
# 創(chuàng)建啟動腳本
cat > ${CONFIG_DIR}/start_all.sh << 'EOF'
#!/bin/bash
# 啟動所有socat轉(zhuǎn)發(fā)
echo "啟動所有socat轉(zhuǎn)發(fā)服務(wù)..."
# 啟動Web轉(zhuǎn)發(fā)
socat TCP-LISTEN:9080,fork,reuseaddr TCP:192.168.1.100:80 &
WEB_PID=$!
echo "Web轉(zhuǎn)發(fā)啟動 (PID: $WEB_PID)"
# 啟動數(shù)據(jù)庫轉(zhuǎn)發(fā)
socat TCP-LISTEN:93306,fork,reuseaddr TCP:192.168.1.100:3306 &
DB_PID=$!
echo "數(shù)據(jù)庫轉(zhuǎn)發(fā)啟動 (PID: $DB_PID)"
# 保存PID文件
echo "$WEB_PID $DB_PID" > /tmp/socat_pids.txt
echo "所有服務(wù)已啟動"
echo "停止所有服務(wù): kill \$(cat /tmp/socat_pids.txt)"
EOF
chmod +x ${CONFIG_DIR}/start_all.sh
echo "高級socat配置已生成在: ${CONFIG_DIR}"
echo "配置文件:"
ls -la ${CONFIG_DIR}/
5. iptables端口轉(zhuǎn)發(fā)方案
5.1 iptables轉(zhuǎn)發(fā)原理
iptables是Linux內(nèi)核的包過濾系統(tǒng)，可以用于實現(xiàn)網(wǎng)絡(luò)地址轉(zhuǎn)換(NAT)和端口轉(zhuǎn)發(fā)。其數(shù)據(jù)流向如下：
5.2 基礎(chǔ)端口轉(zhuǎn)發(fā)配置
創(chuàng)建配置文件：iptables_basic.sh
#!/bin/bash
# iptables_basic.sh - 基礎(chǔ)iptables端口轉(zhuǎn)發(fā)
INTERNAL_HOST="192.168.1.100"
INTERNAL_PORT="8080"
EXTERNAL_PORT="9000"
EXTERNAL_IFACE="eth0" # 根據(jù)實際情況修改
echo "配置iptables端口轉(zhuǎn)發(fā)..."
echo "外部端口: ${EXTERNAL_PORT} -> 內(nèi)部: ${INTERNAL_HOST}:${INTERNAL_PORT}"
echo "網(wǎng)絡(luò)接口: ${EXTERNAL_IFACE}"
# 檢查是否具有root權(quán)限
if [ "$EUID" -ne 0 ]; then
echo "請使用root權(quán)限運行此腳本"
echo "使用方法: sudo ./iptables_basic.sh"
exit 1
fi
# 啟用IP轉(zhuǎn)發(fā)
echo "啟用IP轉(zhuǎn)發(fā)..."
echo '1' > /proc/sys/net/ipv4/ip_forward
sysctl -w net.ipv4.ip_forward=1
# 配置端口轉(zhuǎn)發(fā)規(guī)則
echo "添加iptables規(guī)則..."
# 1. 在nat表的PREROUTING鏈中添加DNAT規(guī)則
iptables -t nat -A PREROUTING -i ${EXTERNAL_IFACE} -p tcp --dport ${EXTERNAL_PORT} \
-j DNAT --to-destination ${INTERNAL_HOST}:${INTERNAL_PORT}
# 2. 在nat表的POSTROUTING鏈中添加SNAT規(guī)則
iptables -t nat -A POSTROUTING -o ${EXTERNAL_IFACE} -p tcp -d ${INTERNAL_HOST} --dport ${INTERNAL_PORT} \
-j MASQUERADE
# 3. 在filter表中允許轉(zhuǎn)發(fā)的流量
iptables -A FORWARD -i ${EXTERNAL_IFACE} -o ${EXTERNAL_IFACE} -p tcp \
--dport ${INTERNAL_PORT} -d ${INTERNAL_HOST} -j ACCEPT
iptables -A FORWARD -i ${EXTERNAL_IFACE} -o ${EXTERNAL_IFACE} -p tcp \
--sport ${INTERNAL_PORT} -s ${INTERNAL_HOST} -j ACCEPT
echo "iptables規(guī)則配置完成"
echo "當(dāng)前NAT表規(guī)則:"
iptables -t nat -L -n -v
echo "當(dāng)前FILTER表規(guī)則:"
iptables -L FORWARD -n -v
5.3 持久化iptables規(guī)則
創(chuàng)建配置文件：iptables_persistent.sh
#!/bin/bash
# iptables_persistent.sh - iptables規(guī)則持久化
RULES_FILE="/etc/iptables/rules.v4"
BACKUP_DIR="./iptables_backup"
echo "配置iptables規(guī)則持久化..."
# 檢查root權(quán)限
if [ "$EUID" -ne 0 ]; then
echo "請使用root權(quán)限運行此腳本"
exit 1
fi
# 創(chuàng)建備份目錄
mkdir -p ${BACKUP_DIR}
BACKUP_FILE="${BACKUP_DIR}/rules.v4.backup.$(date +%Y%m%d_%H%M%S)"
# 備份當(dāng)前規(guī)則
echo "備份當(dāng)前iptables規(guī)則..."
iptables-save > ${BACKUP_FILE}
echo "規(guī)則已備份到: ${BACKUP_FILE}"
# 安裝iptables-persistent（如果未安裝）
if ! command -v netfilter-persistent > /dev/null; then
echo "安裝iptables-persistent..."
apt update
apt install -y iptables-persistent
fi
# 保存當(dāng)前規(guī)則
echo "保存當(dāng)前規(guī)則到持久化文件..."
iptables-save > ${RULES_FILE}
# 創(chuàng)建系統(tǒng)服務(wù)腳本
cat > /etc/systemd/system/iptables-load.service << EOF
[Unit]
Description=Load iptables rules
After=network.target
[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore < ${RULES_FILE}
ExecReload=/sbin/iptables-restore < ${RULES_FILE}
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
EOF
# 啟用服務(wù)
systemctl daemon-reload
systemctl enable iptables-load.service
echo "iptables規(guī)則持久化配置完成"
echo "規(guī)則文件: ${RULES_FILE}"
echo "備份文件: ${BACKUP_FILE}"
echo "服務(wù)狀態(tài): systemctl status iptables-load"
5.4 高級iptables轉(zhuǎn)發(fā)配置
創(chuàng)建配置文件：iptables_advanced.sh
#!/bin/bash
# iptables_advanced.sh - 高級iptables轉(zhuǎn)發(fā)配置
if [ "$EUID" -ne 0 ]; then
echo "請使用root權(quán)限運行此腳本"
exit 1
fi
CONFIG_DIR="./iptables_advanced"
mkdir -p ${CONFIG_DIR}
# 創(chuàng)建端口轉(zhuǎn)發(fā)配置函數(shù)
create_forward_rule() {
local name=$1
local ext_port=$2
local int_host=$3
local int_port=$4
local protocol=${5:-tcp}
cat > ${CONFIG_DIR}/forward_${name}.sh << EOF
# !/bin/bash
# ${name}端口轉(zhuǎn)發(fā)配置
echo "配置${name}端口轉(zhuǎn)發(fā)..."
echo "外部端口: \${EXT_PORT} -> 內(nèi)部: \${INT_HOST}:\${INT_PORT}"
# 啟用IP轉(zhuǎn)發(fā)
echo '1' > /proc/sys/net/ipv4/ip_forward
# 清理舊規(guī)則
iptables -t nat -D PREROUTING -p ${protocol} --dport ${ext_port} -j DNAT --to-destination ${int_host}:${int_port} 2>/dev/null
iptables -t nat -D POSTROUTING -p ${protocol} -d ${int_host} --dport ${int_port} -j MASQUERADE 2>/dev/null
# 添加新規(guī)則
iptables -t nat -A PREROUTING -p ${protocol} --dport ${ext_port} \\
-j DNAT --to-destination ${int_host}:${int_port}
iptables -t nat -A POSTROUTING -p ${protocol} -d ${int_host} --dport ${int_port} \\
-j MASQUERADE
# 允許轉(zhuǎn)發(fā)
iptables -A FORWARD -p ${protocol} --dport ${int_port} -d ${int_host} -j ACCEPT
iptables -A FORWARD -p ${protocol} --sport ${int_port} -s ${int_host} -j ACCEPT
echo "${name}轉(zhuǎn)發(fā)規(guī)則配置完成"
EOF
chmod +x ${CONFIG_DIR}/forward_${name}.sh
}
# 創(chuàng)建多個轉(zhuǎn)發(fā)規(guī)則
create_forward_rule "web" "80" "192.168.1.100" "8080"
create_forward_rule "https" "443" "192.168.1.100" "8443"
create_forward_rule "ssh" "2222" "192.168.1.100" "22"
create_forward_rule "database" "3306" "192.168.1.101" "3306"
# 創(chuàng)建管理腳本
cat > ${CONFIG_DIR}/manage_forwarding.sh << 'EOF'
#!/bin/bash
# iptables轉(zhuǎn)發(fā)管理腳本
ACTION=${1:-status}
case $ACTION in
start)
echo "啟動所有端口轉(zhuǎn)發(fā)..."
for script in ${CONFIG_DIR}/forward_*.sh; do
if [ -f "$script" ]; then
echo "執(zhí)行: $script"
$script
fi
done
;;
stop)
echo "停止所有端口轉(zhuǎn)發(fā)..."
# 清理NAT規(guī)則
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
iptables -F FORWARD
echo "所有轉(zhuǎn)發(fā)規(guī)則已清理"
;;
status)
echo "當(dāng)前NAT表規(guī)則:"
iptables -t nat -L -n
echo ""
echo "當(dāng)前FORWARD鏈規(guī)則:"
iptables -L FORWARD -n
;;
save)
iptables-save > /etc/iptables/rules.v4
echo "規(guī)則已保存"
;;
*)
echo "使用方法: $0 {start|stop|status|save}"
exit 1
;;
esac
EOF
chmod +x ${CONFIG_DIR}/manage_forwarding.sh
echo "高級iptables配置已生成在: ${CONFIG_DIR}"
echo "管理腳本: ${CONFIG_DIR}/manage_forwarding.sh"
echo "使用方法:"
echo " sudo ${CONFIG_DIR}/manage_forwarding.sh start # 啟動所有轉(zhuǎn)發(fā)"
echo " sudo ${CONFIG_DIR}/manage_forwarding.sh stop # 停止所有轉(zhuǎn)發(fā)"
echo " sudo ${CONFIG_DIR}/manage_forwarding.sh status # 查看狀態(tài)"
echo " sudo ${CONFIG_DIR}/manage_forwarding.sh save # 保存規(guī)則"
6. 三種方案對比測試
6.1 性能測試腳本
創(chuàng)建配置文件：performance_test.sh
#!/bin/bash
# performance_test.sh - 三種方案性能對比測試
TEST_DURATION=30
TARGET_HOST="192.168.1.100"
TARGET_PORT="8080"
LOCAL_PORT="9000"
RESULTS_FILE="./performance_results.txt"
echo "開始性能測試..."
echo "測試時長: ${TEST_DURATION}秒"
echo "目標(biāo)服務(wù): ${TARGET_HOST}:${TARGET_PORT}"
# 安裝測試工具
if ! command -v ab > /dev/null; then
echo "安裝Apache Bench..."
apt update
apt install -y apache2-utils
fi
# 清理舊結(jié)果
> ${RESULTS_FILE}
test_ssh_forwarding() {
echo "測試SSH端口轉(zhuǎn)發(fā)性能..."
# 啟動SSH轉(zhuǎn)發(fā)后臺進(jìn)程
ssh -N -L ${LOCAL_PORT}:${TARGET_HOST}:${TARGET_PORT} user@${TARGET_HOST} &
SSH_PID=$!
# 等待連接建立
sleep 5
# 運行性能測試
ab -n 1000 -c 10 http://127.0.0.1:${LOCAL_PORT}/ > /tmp/ssh_test.txt 2>&1
# 提取結(jié)果
REQUESTS_PER_SECOND=$(grep "Requests per second" /tmp/ssh_test.txt | awk '{print $4}')
TIME_PER_REQUEST=$(grep "Time per request" /tmp/ssh_test.txt | head -1 | awk '{print $4}')
echo "SSH結(jié)果: ${REQUESTS_PER_SECOND} req/sec, ${TIME_PER_REQUEST} ms/req"
echo "SSH: ${REQUESTS_PER_SECOND} req/sec, ${TIME_PER_REQUEST} ms/req" >> ${RESULTS_FILE}
# 清理
kill ${SSH_PID}
}
test_socat_forwarding() {
echo "測試socat端口轉(zhuǎn)發(fā)性能..."
# 啟動socat轉(zhuǎn)發(fā)
socat TCP-LISTEN:${LOCAL_PORT},fork,reuseaddr TCP:${TARGET_HOST}:${TARGET_PORT} &
SOCAT_PID=$!
sleep 2
# 運行性能測試
ab -n 1000 -c 10 http://127.0.0.1:${LOCAL_PORT}/ > /tmp/socat_test.txt 2>&1
# 提取結(jié)果
REQUESTS_PER_SECOND=$(grep "Requests per second" /tmp/socat_test.txt | awk '{print $4}')
TIME_PER_REQUEST=$(grep "Time per request" /tmp/socat_test.txt | head -1 | awk '{print $4}')
echo "socat結(jié)果: ${REQUESTS_PER_SECOND} req/sec, ${TIME_PER_REQUEST} ms/req"
echo "socat: ${REQUESTS_PER_SECOND} req/sec, ${TIME_PER_REQUEST} ms/req" >> ${RESULTS_FILE}
# 清理
kill ${SOCAT_PID}
}
test_iptables_forwarding() {
echo "測試iptables端口轉(zhuǎn)發(fā)性能..."
if [ "$EUID" -ne 0 ]; then
echo "需要root權(quán)限測試iptables"
return
fi
# 配置iptables轉(zhuǎn)發(fā)
./iptables_basic.sh
# 運行性能測試
ab -n 1000 -c 10 http://127.0.0.1:${LOCAL_PORT}/ > /tmp/iptables_test.txt 2>&1
# 提取結(jié)果
REQUESTS_PER_SECOND=$(grep "Requests per second" /tmp/iptables_test.txt | awk '{print $4}')
TIME_PER_REQUEST=$(grep "Time per request" /tmp/iptables_test.txt | head -1 | awk '{print $4}')
echo "iptables結(jié)果: ${REQUESTS_PER_SECOND} req/sec, ${TIME_PER_REQUEST} ms/req"
echo "iptables: ${REQUESTS_PER_SECOND} req/sec, ${TIME_PER_REQUEST} ms/req" >> ${RESULTS_FILE}
# 清理規(guī)則
iptables -t nat -F
}
# 執(zhí)行測試
test_ssh_forwarding
test_socat_forwarding
test_iptables_forwarding
echo "性能測試完成"
echo "結(jié)果保存在: ${RESULTS_FILE}"
cat ${RESULTS_FILE}
6.2 功能對比表格
創(chuàng)建配置文件：feature_comparison.md
三種端口轉(zhuǎn)發(fā)方案功能對比
| 特性 | SSH | socat | iptables |
|---|---|---|---|
| 加密支持 | ? 原生支持 | ? 需要SSL配置 | ? 無加密 |
| 認(rèn)證機(jī)制 | ? 多種認(rèn)證方式 | ? 無認(rèn)證 | ? 無認(rèn)證 |
| 配置復(fù)雜度 | 中等 | 簡單 | 復(fù)雜 |
| 性能開銷 | 高（加密開銷） | 中等 | 低（內(nèi)核級） |
| 持久化 | 需要腳本或服務(wù) | 需要腳本或服務(wù) | 需要額外配置 |
| 跨平臺 | ? 全平臺支持 | ? 全平臺支持 | ? 僅Linux |
| UDP支持 | ? 有限支持 | ? 完整支持 | ? 完整支持 |
| 調(diào)試能力 | 中等 | 優(yōu)秀 | 困難 |
| 系統(tǒng)依賴 | SSH客戶端/服務(wù) | socat二進(jìn)制 | iptables工具 |
| 適用場景 | 安全遠(yuǎn)程訪問、臨時轉(zhuǎn)發(fā) | 協(xié)議轉(zhuǎn)換、調(diào)試工具 | 生產(chǎn)環(huán)境、網(wǎng)關(guān)轉(zhuǎn)發(fā) |
推薦使用場景
SSH端口轉(zhuǎn)發(fā)
- 需要加密的安全連接
- 臨時性的端口轉(zhuǎn)發(fā)需求
- 跨越防火墻的訪問
- 開發(fā)調(diào)試環(huán)境
socat端口轉(zhuǎn)發(fā)
- 協(xié)議轉(zhuǎn)換和調(diào)試
- 復(fù)雜的流處理需求
- 快速測試和原型驗證
- UDP端口轉(zhuǎn)發(fā)
iptables端口轉(zhuǎn)發(fā)
- 生產(chǎn)環(huán)境部署
- 高性能要求的場景
- 系統(tǒng)級端口轉(zhuǎn)發(fā)
- 網(wǎng)關(guān)和路由器配置
7. 實際應(yīng)用案例
7.1 生產(chǎn)環(huán)境部署腳本
創(chuàng)建配置文件：production_deploy.sh
#!/bin/bash
# production_deploy.sh - 生產(chǎn)環(huán)境端口轉(zhuǎn)發(fā)部署
set -e # 遇到錯誤立即退出
echo "生產(chǎn)環(huán)境端口轉(zhuǎn)發(fā)部署腳本"
echo "================================"
DEPLOY_MODE=${1:-"iptables"} # 默認(rèn)使用iptables
CONFIG_FILE="./deploy_config.conf"
# 加載配置
if [ -f "${CONFIG_FILE}" ]; then
source "${CONFIG_FILE}"
else
# 默認(rèn)配置
TARGET_SERVICES=(
"web:80:192.168.1.100:8080"
"api:8080:192.168.1.101:3000"
"db:3306:192.168.1.102:3306"
)
MONITOR_PORT="9090"
LOG_DIR="/var/log/port_forwarding"
fi
setup_monitoring() {
echo "設(shè)置監(jiān)控和日志..."
mkdir -p ${LOG_DIR}
# 安裝監(jiān)控工具
apt install -y htop iotop nethogs
# 創(chuàng)建監(jiān)控腳本
cat > /usr/local/bin/monitor_forwarding.sh << 'EOF'
#!/bin/bash
# 端口轉(zhuǎn)發(fā)監(jiān)控腳本
echo "端口轉(zhuǎn)發(fā)狀態(tài)監(jiān)控"
echo "=================="
echo "當(dāng)前時間: $(date)"
echo ""
echo "1. 網(wǎng)絡(luò)連接統(tǒng)計:"
netstat -tulpn | grep -E ":(9000|8080|3306)" | sort
echo ""
echo "2. 系統(tǒng)資源使用:"
ps aux --sort=-%cpu | head -10
echo ""
echo "3. 網(wǎng)絡(luò)流量:"
nethogs -t -d 1 -c 2 | head -20
EOF
chmod +x /usr/local/bin/monitor_forwarding.sh
}
deploy_iptables() {
echo "部署iptables端口轉(zhuǎn)發(fā)..."
# 調(diào)用高級配置
./iptables_advanced/manage_forwarding.sh start
# 設(shè)置定時監(jiān)控
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/local/bin/monitor_forwarding.sh >> ${LOG_DIR}/monitor.log") | crontab -
}
deploy_socat() {
echo "部署socat端口轉(zhuǎn)發(fā)..."
# 創(chuàng)建systemd服務(wù)
for service in "${TARGET_SERVICES[@]}"; do
IFS=':' read -r name ext_port int_host int_port <<< "$service"
cat > /etc/systemd/system/socat-${name}.service << EOF
[Unit]
Description=socat port forwarding for ${name}
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/socat TCP-LISTEN:${ext_port},fork,reuseaddr TCP:${int_host}:${int_port}
Restart=always
RestartSec=3
User=root
StandardOutput=journal
StandardError=journal
[Install]
WantedBy=multi-user.target
EOF
systemctl enable socat-${name}.service
systemctl start socat-${name}.service
echo "服務(wù) socat-${name} 已啟動"
done
}
case $DEPLOY_MODE in
"iptables")
deploy_iptables
;;
"socat")
deploy_socat
;;
"ssh")
echo "SSH轉(zhuǎn)發(fā)通常用于臨時需求，不建議生產(chǎn)環(huán)境持久化部署"
;;
*)
echo "未知的部署模式: $DEPLOY_MODE"
echo "可用模式: iptables, socat, ssh"
exit 1
;;
esac
setup_monitoring
echo "部署完成!"
echo "監(jiān)控日志: ${LOG_DIR}"
echo "實時監(jiān)控: /usr/local/bin/monitor_forwarding.sh"
8. 故障排除與維護(hù)
8.1 常見問題診斷腳本
創(chuàng)建配置文件：troubleshooting.sh
#!/bin/bash
# troubleshooting.sh - 端口轉(zhuǎn)發(fā)故障診斷
echo "端口轉(zhuǎn)發(fā)故障診斷工具"
echo "======================"
check_connectivity() {
echo "1. 檢查基礎(chǔ)連通性..."
if ping -c 3 $1 &> /dev/null; then
echo "? 可以ping通目標(biāo)主機(jī): $1"
else
echo "? 無法ping通目標(biāo)主機(jī): $1"
return 1
fi
if nc -z $1 $2 &> /dev/null; then
echo "? 目標(biāo)服務(wù)端口可訪問: $1:$2"
else
echo "? 目標(biāo)服務(wù)端口不可訪問: $1:$2"
return 1
fi
}
check_forwarding_rules() {
echo ""
echo "2. 檢查轉(zhuǎn)發(fā)規(guī)則..."
case $1 in
"iptables")
echo "檢查iptables規(guī)則:"
iptables -t nat -L -n | grep -E "DNAT|REDIRECT"
iptables -L FORWARD -n | head -10
;;
"socat")
echo "檢查socat進(jìn)程:"
ps aux | grep socat | grep -v grep
netstat -tulpn | grep socat
;;
"ssh")
echo "檢查SSH隧道:"
ps aux | grep "ssh.*-L\|ssh.*-R" | grep -v grep
netstat -tulpn | grep ssh
;;
esac
}
check_firewall() {
echo ""
echo "3. 檢查防火墻設(shè)置..."
if command -v ufw > /dev/null; then
echo "UFW狀態(tài):"
ufw status verbose
fi
if command -v firewall-cmd > /dev/null; then
echo "firewalld狀態(tài):"
firewall-cmd --list-all
fi
echo "iptables默認(rèn)策略:"
iptables -L | grep "policy"
}
check_system_resources() {
echo ""
echo "4. 檢查系統(tǒng)資源..."
echo "內(nèi)存使用:"
free -h
echo ""
echo "CPU負(fù)載:"
uptime
echo ""
echo "網(wǎng)絡(luò)連接數(shù):"
netstat -an | grep -c ESTABLISHED
}
perform_deep_diagnosis() {
echo ""
echo "5. 深度診斷..."
echo "內(nèi)核參數(shù):"
sysctl net.ipv4.ip_forward
echo ""
echo "路由表:"
ip route show
echo ""
echo "網(wǎng)絡(luò)接口:"
ip addr show
echo ""
echo "連接跟蹤:"
if [ -f /proc/sys/net/netfilter/nf_conntrack_count ]; then
echo "連接跟蹤數(shù): $(cat /proc/sys/net/netfilter/nf_conntrack_count)"
fi
}
# 執(zhí)行診斷
TARGET_HOST=${1:-"192.168.1.100"}
TARGET_PORT=${2:-"8080"}
FORWARD_TYPE=${3:-"iptables"}
check_connectivity $TARGET_HOST $TARGET_PORT
check_forwarding_rules $FORWARD_TYPE
check_firewall
check_system_resources
perform_deep_diagnosis
echo ""
echo "診斷完成!"
echo "根據(jù)上述檢查結(jié)果排查問題"
9. 總結(jié)
本文詳細(xì)介紹了Linux下三種主要的端口轉(zhuǎn)發(fā)方案：SSH、socat和iptables。每種方案都有其獨特的優(yōu)勢和適用場景：
- SSH：適合需要加密的安全場景和臨時轉(zhuǎn)發(fā)需求
- socat：功能強(qiáng)大，適合協(xié)議轉(zhuǎn)換和復(fù)雜的數(shù)據(jù)流處理
- iptables：性能最佳，適合生產(chǎn)環(huán)境的系統(tǒng)級轉(zhuǎn)發(fā)
通過本文提供的完整配置腳本和詳細(xì)說明，即使是Linux新手也可以成功部署和使用這些端口轉(zhuǎn)發(fā)方案。在實際應(yīng)用中，建議根據(jù)具體需求選擇合適的方案，并結(jié)合監(jiān)控和故障排除工具確保服務(wù)的穩(wěn)定性。
以上就是Linux下端口轉(zhuǎn)發(fā)的三種常見方案及對比詳解的詳細(xì)內(nèi)容，更多關(guān)于Linux端口轉(zhuǎn)發(fā)方案的資料請關(guān)注腳本之家其它相關(guān)文章！
相關(guān)文章
Linux中創(chuàng)建新用戶并賦予指定目錄的相關(guān)權(quán)限
這篇文章主要介紹了Linux中創(chuàng)建新用戶并賦予指定目錄的相關(guān)權(quán)限,本文給大家介紹的非常詳細(xì)，具有一定的參考借鑒價值，需要的朋友可以參考下2019-11-11
本篇文章主要介紹了linux如何無損調(diào)整分區(qū)大小，小編覺得挺不錯的，現(xiàn)在分享給大家，也給大家做個參考。一起跟隨小編過來看看吧2017-05-05
文章介紹了兩種查看顯卡型號的方法：在系統(tǒng)內(nèi)部執(zhí)行命令或通過官方網(wǎng)站查詢,這兩種方法都可以幫助用戶獲取顯卡的具體型號,文章提到這是個人經(jīng)驗,并鼓勵大家支持腳本之家2026-02-02
Linux內(nèi)核設(shè)備驅(qū)動之Linux內(nèi)核基礎(chǔ)筆記整理
今天小編就為大家分享一篇關(guān)于Linux內(nèi)核設(shè)備驅(qū)動之Linux內(nèi)核基礎(chǔ)筆記整理，小編覺得內(nèi)容挺不錯的，現(xiàn)在分享給大家，具有很好的參考價值，需要的朋友一起跟隨小編來看看吧2018-12-12
這篇文章主要介紹了Centos7如何升級GCC的實現(xiàn)過程,具有很好的參考價值,希望對大家有所幫助,如有錯誤或未考慮完全的地方,望不吝賜教2026-03-03
ncdu?（NCurses?Disk?Usage）?是一個用于?Linux?和類?unix?系統(tǒng)的磁盤實用程序,它提供了一種比?du?等傳統(tǒng)命令更具交互性和用戶友好性的方式來查看和分析磁盤空間使用情況,本文給大家介紹了Linux使用ncdu查看磁盤使用的操作,需要的朋友可以參考下2025-02-02
這篇文章主要介紹了Linux下如何安裝Logstash問題，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教2023-06-06
Linux中如何修改~/.bashrc或/etc/profile設(shè)置環(huán)境變量
這篇文章主要介紹了Linux中如何修改~/.bashrc或/etc/profile設(shè)置環(huán)境變量問題，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教2023-05-05
Linux系統(tǒng)中的日志文件會隨時間增長,手動清理較為繁瑣,logrotate程序可自動執(zhí)行日志文件的輪換、壓縮、刪除和郵件發(fā)送,節(jié)省磁盤空間,logrotate基于crontab運行,調(diào)用配置文件/etc/logrotate.conf,用戶可在/etc/logrotate.d目錄放置自定義配置文件2024-10-10
Ubuntu?Server?22.04.5?入門篇：詳盡安裝部署指南
這篇文章主要介紹了Ubuntu?Server?22.04.5?入門篇：詳盡安裝部署指南,需要的朋友可以參考下2025-03-03