linux配置映射

‘壹’ 在linux上做端口映射

#假设你的内网ip为 192.168.1.22外网202.102.99.99
修改/etc/sysconfig/iptables添加
-A PREROUTING -d 202.102.99.99 -p tcp --dport 8085 -j DNAT --to-destination 192.168.1.22:8085
-A POSTROUTING -d 192.168.1.22 -p tcp --dport 8085 -j SNAT --to 202.102.99.99

‘贰’ Linux SAMBA服务器配置共享目录，访问控制，用户映射

[global]

# ----------------------- Network Related Options-------------------------
#
# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
#
# server string is the equivalent of the NT Description field
#
# netbios name can be used to specify a server name not tied to thehostname
#
# Interfaces lets you configure Samba to use multiple interfaces
# If you have multiple network interfaces then you can list the ones
# you want to listen on (never omit localhost)
#
# Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
# specifiy it as a per share option as well
#
workgroup = MYGROUP
server string = Samba Server Version%v

; netbios name = MYSERVER

interfaces = lo eth0
hosts allow = 192.168.1.
user map =/etc/samba/smbusermap

# --------------------------- Logging Options-----------------------------
#
# Log File let you specify where to put logs and how to split them up.
#
# Max Log Size let you specify the max size log files should reach

# logs split per machine
log file = /var/log/samba/log.%m
# max 50KB per log file, thenrotate
max log size = 50

# ----------------------- Standalone Server Options------------------------
#
# Scurity can be set to user, share(deprecated) or server(deprecated)
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.

security = user
passdb backend = tdbsam

# ----------------------- Domain Members Options ------------------------
#
# Security must be set to domain or ads
#
# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Use password server option only with security = server or if you can't
# use the DNS to locate Domain Controllers
# The argument list may include:
# password server = My_PDC_Name[My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *

; security = domain
; passdb backend = tdbsam
; realm = MY_REALM

; password server =<NT-Server-Name>

# ----------------------- Domain Controller Options------------------------
#
# Security must be set to user for domain controllers
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
#
# Domain Logons let Samba be a domain logon server for Windows workstations.
#
# Logon Scrpit let yuou specify a script to be run at login time on theclient
# You need to provide it in a share called NETLOGON
#
# Logon Path let you specify where user profiles are stored (UNC path)
#
# Various scripts can be used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
#
; security = user
; passdb backend = tdbsam

; domain master = yes
; domain logons = yes

# the login script name depends on themachine name
; logon script = %m.bat
# the login script name depends on theunix user used
; logon script = %u.bat
; logon path = \\%L\Profiles\%u
# disables profiles support byspecifing an empty path
; logon path =

; add user script = /usr/sbin/useradd"%u" -n -g users
; add group script = /usr/sbin/groupadd"%g"
; add machine script = /usr/sbin/useradd-n -c "Workstation (%u)" -M -d /nohome -s /bin/false"%u"
; delete user script = /usr/sbin/userdel"%u"
; delete user from group script =/usr/sbin/userdel "%u" "%g"
; delete group script =/usr/sbin/groupdel "%g"

# ----------------------- Browser Control Options----------------------------
#
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
#
# Preferred Master causes Samba to force a local browser election onstartup
# and gives it a slightly higher chance of winning the election
; local master = no
; os level = 33
; preferred master = yes

#----------------------------- Name Resolution -------------------------------
# Windows Internet Name Serving Support Section:
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#
# - WINS Support: Tells the NMBD component of Samba to enable it's WINSServer
#
# - WINS Server: Tells the NMBD components of Samba to be a WINS Client
#
# - WINS Proxy: Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client,for this to work there must be
# at least one WINS Server on the network. The default is NO.
#
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.

; wins support = yes
; wins server = w.x.y.z
; wins proxy = yes

; dns proxy = yes

# --------------------------- Printing Options-----------------------------
#
# Load Printers let you load automatically the list of printers rather
# than setting them up indivially
#
# Cups Options let you pass the cups libs custom options, setting it toraw
# for example will let you use drivers on your Windows clients
#
# Printcap Name let you specify an alternative printcap file
#
# You can choose a non default printing system using the Printing option

load printers = no
cups options = raw

; printcap name = /etc/printcap
#obtain list of printers automaticallyon SystemV
; printcap name = lpstat
; printing = cups

# --------------------------- Filesystem Options---------------------------
#
# The following options can be uncommented if the filesystem supports
# Extended Attributes and they are enabled (usually by the mount option
# user_xattr). Thess options will let the admin store the DOS attributes
# in an EA and make samba not mess with the permission bits.
#
# Note: these options can also be set just per share, setting them inglobal
# makes them the default for all shares

; map archive = no
; map hidden = no
; map read only = no
; map system = no
; store dos attributes = yes

#============================ Share Definitions==============================

[homes]
comment = Home Directories
browseable = no
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[sales]
comment = Home Directories
path=/var/samba/sales
browseable = no
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[finance]
comment = Home Directories
browseable = yes
path=/var/samba/finance
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes

# Un-comment the following and create the netlogon directory for DomainLogons
; [netlogon]
; comment = Network Logon Service
; path = /var/lib/samba/netlogon
; guest ok = yes
; writable = no
; share modes = no

# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
; [Profiles]
; path = /var/lib/samba/profiles
; browseable = no
; guest ok = yes

# A publicly accessible directory, but read only, except for people in
# the "staff" group
; [public]
; comment = Public Stuff
; path = /home/samba
; public = yes
; writable = yes
; printable = no
; write list = +staff

以上是smb.conf内的配置。
增加用户和组，并设置好用户组的隶属关系。
用smbpasswd -a 增加smb访问密码。

‘叁’ linux服务器IP地址映射问题

首先你要确认你的linux系统防火墙有没有开放22端口（默认是开放的），第二个就是你的ip地址了，你linux的ip地址是局域网的ip地址，第三就是你的端口映射是否做的正确，你的linux防火墙是否允许你外网的映射的那个地址进入 第四就是你访问的时候是否是通过外网地址访问的

‘肆’ 请问如何给linux端口映射，我想让外网访问！虚拟机linux系统

在nat.conf里可以配置端口映射，之后在Linux里设置防火墙添加访问的端口

‘伍’ LINUX服务器的端口映射

开放内部主机可以 ftp 至外部的主机
开放内部网路，可以 ftp 至外部主机。

作法如下∶(预设 policy 为 DROP)

###-----------------------------------------------------###
# open 对外部主机 ftp port 21
###-----------------------------------------------------###

# 以下是打开命令 channel 21
iptables -A OUTPUT -o eth0 -p tcp -s $FW_IP --sport 1024:65535 -d any/0 --dport 21 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp ! --syn -s any/0 --sport 21 -d $FW_IP --dport 1024:65535 -j ACCEPT

# 以下是打开资料 channel 20
iptables -A INPUT -i eth0 -p tcp -s any/0 --sport 20 -d $FW_IP --dport 1024:65535 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp ! --syn -s $FW_IP --sport 1024:65535 -d any/0 --dport 20 -j ACCEPT

# 以下是打开 passive mode FTP 资料通道
iptables -A OUTPUT -o eth0 -p tcp -s $FW_IP --sport 1024:65535 -d any/0 --dport 1024:65535 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp ! --syn -s any/0 --sport 1024:65535 -d $FW_IP --dport 1024:65535 -j ACCEPT

‘陆’ 怎样在Linux 5上添加裸设备映射

解决方法:
裸设备接口在红帽企业Linux 5上已经被去掉了。现在可以通过udev规则配置裸设备。
为了添加裸设备映射，在/etc/udev/rules.d/60-raw.rules 添加一行，格式和下面的一样：
ACTION=="add", KERNEL="<device name>", RUN+="raw /dev/raw/rawX %N"

主/从号：
ACTION=="add", ENV{MAJOR}="A", ENV{MINOR}="B", RUN+="raw /dev/raw/rawX %M %m"

以需要邦定的设备名（例如/dev/sda1）替换上面的<device name>。"A"和"B"是需要邦定的主/从号。"X"是系统将要使用的裸设备的序号。
如果之前存在一个大的/etc/sysconfig/rawdevices文件，可以使用下面的脚本作转换：
#!/bin/sh
grep -v "^ *#" /etc/sysconfig/rawdevices | grep -v "^$" | while read dev major
minor ; do
if [ -z "$minor" ]; then
echo "ACTION==\"add\", KERNEL==\"${major##/dev/}\",
RUN+=\"/usr/bin/raw $dev %N\""
else
echo "ACTION==\"add\", ENV{MAJOR}==\"$major\",
ENV{MINOR}==\"$minor\", RUN+=\"/usr/bin/raw $dev %M %m\""
fi
done

AS5 和AS4 的方法完全不同
AS5
设置重新启动自动挂载裸设备
vi /etc/udev/rules.d/60-raw.rules
ACTION=="add", KERNEL=="sdd1", RUN+="/bin/raw /dev/raw/raw1 %N"
ACTION=="add", KERNEL=="sde1", RUN+="/bin/raw /dev/raw/raw2 %N"
ACTION=="add", KERNEL=="sdf1", RUN+="/bin/raw /dev/raw/raw3 %N"

AS4
vi /etc/sysconfig/rawdevices
/dev/raw/raw1 /dev/sdc1
/dev/raw/raw2 /dev/sdd1
# /sbin/service rawdevices restart

-------------------------------------------------------------------------------------------------
绑定裸设备
raw /dev/raw/raw<N> /dev/<blockdev>
删除裸设备
raw /dev/raw/raw<N> 0 0
如用raw /dev/raw/raw1 0 0 删除裸设备/dev/raw/raw1

‘柒’ linux虚拟机上的文件怎么映射到主机上

先确认虚拟机是关闭状态（susppend时无法修改属性）
再修改虚拟机属性：（操作如下）
edit
virtual
machine
settings(编辑)
-
options(属性)
-
shared
folders（选为always
enabled）
再"添加"对应的windows磁盘目录
最后在虚拟的linux下安装vmtools后，访问/mnt/hfgs目录即可
可以多关注《linux就该这么学》这本书，我都是从这里面学到的

‘捌’ linux做路由.如何映射端口啊

1. 源NAT(SNAT)
更改所有来自192.168.1.0/24的数据包的源ip地址为1.2.3.4：
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to 1.2.3.4
这里需要注意的是，系统在路由及过虑等处理直到数据包要被送出时才进行SNAT。
有一种SNAT的特殊情况是ip欺骗，也就是所谓的Masquerading，通常建议在使用拨号上网的时候使用，或者说在合法ip地址不固定的情况下使用。比如
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
可以看出，这时候我们没有必要显式的指定源ip地址等信息。
2. 目的SNAT(DNAT)
更改所有来自192.168.1.0/24的数据包的目的ip地址为1.2.3.4：
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -i eth1 -j DNAT --to 1.2.3.4
这里需要注意的是，系统是先进行DNAT，然后才进行路由及过虑等操作。
有一种DNAT的特殊情况是重定向，也就是所谓的Redirection，这时候就相当于将符合条件的数据包的目的ip地址改为数据包进入系统时的网络接口的ip地址。通常是在与squid配置形成透明代理时使用，假设squid的监听端口是3128，我们可以通过以下语句来将来自 192.168.1.0/24，目的端口为80的数据包重定向到squid监听
端口：
iptables -t nat -A PREROUTING -i eth1 -p tcp -s 192.168.1.0/24 --dport 80
-j REDIRECT --to-port 3128
1、映射端口和服务器监听端口要对应
比如，默认的Apache和Nginx都监听80端口，当某个IP映射到8002端口，要在相应的服务器配置文件中修改成监听相应8002端口。Nginx的路径一般为/etc/nginx/nginx.conf。
2.防火墙问题
当端口修改后仍然访问不到，要设置防火墙允许通过该端口
（iptables -I UNPUT -p tcp --dport 8010 -j ACCEPT），或者关掉防火墙（service iptables stop）。

‘玖’ Linux端口映射

可以。请参考下面的设定：
【实现功能】

PC A是

eth0 172.18.10.212 内网

eth1 219.239.xx.xx 外网

PC B是 172.18.10.205 内网

A的8080端口映射到B的80端口

【步骤】

1、 首先应该做的是/etc/sysctl.conf配置文件的 net.ipv4.ip_forward = 1 默认是0

这样允许iptalbes FORWARD。

2、 在/etc/rc.d/init.d目录下有iptables 文件，使用格式如下

Usage: ./iptables {start|stop|restart|condrestart|status|panic|save}

相当与service iptables {....}

把iptables 服务停止，清除以前的规则，存盘

到/etc/rc.d/init.d目录下，运行

./iptables stop

iptalbes -F

iptalbes -X

iptalbes -Z

./iptables save
3、 重新配置规则

iptables -t nat -A PREROUTING -d 219.239.xx.xx -p tcp --dport 8080 -j DNAT --to-destination 172.18.10.205:80

iptables -t nat -A POSTROUTING -d 172.18.10.205 -p tcp --dport 80 -j SNAT --to 172.18.10.212

iptables -A FORWARD -o eth0 -d 172.18.10.205 -p tcp --dport 80 -j ACCEPT

iptables -A FORWARD -i eth0 -s 172.18.10.205 -p tcp --sport 80 -j ACCEPT

DNAT SNAT 的请参考帮助，这里不再陈述。

4、 新的规则存盘

./iptables save

规则存盘后在/etc/sysconfig/iptables这个文件里面，若你对这个文件很熟悉

直接修改这里的内容也等于命令行方式输入规则。

5、 启动iptables 服务

./iptables start

在/proc/net/ip_conntrack文件里有包的流向，如下面

tcp 6 53 TIME_WAIT src=../../221.122.59.2 dst=219.239.xx.xx sport=7958 dport=8080 packets=9 bytes=1753

src=../../172.18.10.205 dst=172.18.10.212 sport=80 dport=7958 packets=9 bytes=5777 [ASSURED] use=1