#!/bin/sh
iptables -F -t nat
echo "1" > /proc/sys/net/ipv4/ip_forward
OIF=vmbr0
IIF=vmbr9
SNIP=172.16.255.0/24
# 1. 建立 NAT：將來自 vmbr9 網段的封包，在從 vmbr0 出去時轉換為 vmbr0 的 IP
iptables -t nat -A POSTROUTING -o ${OIF} -s ${SNIP} -j MASQUERADE
# 2. 允許 eth9 到 eth0 的轉發流量 (建立連線)
iptables -A FORWARD -i ${IIF} -o ${OIF} -s ${SNIP} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# 3. 允許從 eth0 回到 eth9 的已建立連線流量 (回應封包)
iptables -A FORWARD -i ${OIF} -o ${IIF} -d ${SNIP} -m state --state ESTABLISHED,RELATED -j ACCEPT
#NAT PORT
OPORT=8007
IPORT=8007
IIP=172.16.255.1
iptables -t nat -A PREROUTING -i ${OIF} -p tcp --dport ${OPORT} -j DNAT --to-destination ${IIP}:${IPORT}
# 2. 確保轉發鏈允許該流量通過 (如果你的 FORWARD 預設是 DROP)
iptables -A FORWARD -p tcp -d ${IIP} --dport ${IPORT} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
OPORT=8443
IPORT=8443
IIP=172.16.255.2
iptables -t nat -A PREROUTING -i ${OIF} -p tcp --dport ${OPORT} -j DNAT --to-destination ${IIP}:${IPORT}
iptables -A FORWARD -p tcp -d ${IIP} --dport ${IPORT} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
