私のネットワーク構成は次のとおりです。
xxx.xxx.xxx.xxx -> nat 1:1 -> 192.168.0.2 -> 80 port forward -> 192.168.0.10
^ ^ ^
| | |
internet VM1 VM2
パブリックデバイス（たとえば、携帯電話）からxxx.xxx.xxx.xxx:80にアクセスしようとすると、すべて正常に動作し、192.168.0.10:80からWebページが表示されます。
問題は:LAN クライアント (例: VM1 と同じネットワーク上の 192.168.0.150) から xxx.xxx.xxx.xxx:80 にアクセスしようとすると、Web サーバー (192.168.0.10:80) に到達できず、接続がタイムアウトになります。
構成は次のとおりです。
VM1 whith dev ens32 -> 192.168.0.2
net.ipv4.ip_forward=1
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t nat -A PREROUTING -p tcp -i ens32 --dport 80 -j DNAT --to-destination 192.168.0.10:80
/sbin/iptables -t nat -A PREROUTING -p tcp -i ens32 --dport 443 -j DNAT --to-destination 192.168.0.10:443
/sbin/iptables -A FORWARD -p tcp -d 192.168.0.10 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -p tcp -d 192.168.0.10 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -o ens32 -j MASQUERADE
アップデート：クライアント (192.168.0.150) からのリクエストの tcpdump トレースを記録しました
16:48:16.227785 IP 192.168.0.150.47391 > 192.168.0.2.https: Flags [S], seq 3088549798, win 65535, options [mss 1460,sackOK,TS val 126143387 ecr 0,nop,wscale 9], length 0
16:48:16.227869 IP 192.168.0.2.47391 > 192.168.0.10.https: Flags [S], seq 3088549798, win 65535, options [mss 1460,sackOK,TS val 126143387 ecr 0,nop,wscale 9], length 0
16:48:16.228268 IP 192.168.0.10.https > 192.168.0.2.47391: Flags [S.], seq 371329525, ack 3088549799, win 28960, options [mss 1460,sackOK,TS val 378079 ecr 126143387,nop,wscale 7], length 0
16:48:16.228296 IP 192.168.0.2.https > 192.168.0.150.47391: Flags [S.], seq 371329525, ack 3088549799, win 28960, options [mss 1460,sackOK,TS val 378079 ecr 126143387,nop,wscale 7], length 0
16:48:16.234087 IP 192.168.0.150.47391 > 192.168.0.2.https: Flags [R], seq 3088549799, win 0, length 0
16:48:16.234113 IP 192.168.0.2.47391 > 192.168.0.10.https: Flags [R], seq 3088549799, win 0, length 0
16:48:16.466921 IP 192.168.0.150.47393 > 192.168.0.2.https: Flags [S], seq 1316556207, win 65535, options [mss 1460,sackOK,TS val 126143412 ecr 0,nop,wscale 9], length 0
16:48:16.466969 IP 192.168.0.2.47393 > 192.168.0.10.https: Flags [S], seq 1316556207, win 65535, options [mss 1460,sackOK,TS val 126143412 ecr 0,nop,wscale 9], length 0
16:48:16.467335 IP 192.168.0.10.https > 192.168.0.2.47393: Flags [S.], seq 1172572926, ack 1316556208, win 28960, options [mss 1460,sackOK,TS val 378138 ecr 126143412,nop,wscale 7], length 0
16:48:16.467360 IP 192.168.0.2.https > 192.168.0.150.47393: Flags [S.], seq 1172572926, ack 1316556208, win 28960, options [mss 1460,sackOK,TS val 378138 ecr 126143412,nop,wscale 7], length 0
16:48:16.469625 IP 192.168.0.150.47393 > 192.168.0.2.https: Flags [R], seq 1316556208, win 0, length 0
16:48:16.469642 IP 192.168.0.2.47393 > 192.168.0.10.https: Flags [R], seq 1316556208, win 0, length 0
16:48:17.211348 IP 192.168.0.150.47391 > 192.168.0.2.https: Flags [S], seq 3088549798, win 65535, options [mss 1460,sackOK,TS val 126143487 ecr 0,nop,wscale 9], length 0
16:48:17.211406 IP 192.168.0.2.47391 > 192.168.0.10.https: Flags [S], seq 3088549798, win 65535, options [mss 1460,sackOK,TS val 126143487 ecr 0,nop,wscale 9], length 0
16:48:17.211783 IP 192.168.0.10.https > 192.168.0.2.47391: Flags [S.], seq 386696842, ack 3088549799, win 28960, options [mss 1460,sackOK,TS val 378324 ecr 126143487,nop,wscale 7], length 0
16:48:17.211807 IP 192.168.0.2.https > 192.168.0.150.47391: Flags [S.], seq 386696842, ack 3088549799, win 28960, options [mss 1460,sackOK,TS val 378324 ecr 126143487,nop,wscale 7], length 0
16:48:17.214283 IP 192.168.0.150.47391 > 192.168.0.2.https: Flags [R], seq 3088549799, win 0, length 0
16:48:17.214301 IP 192.168.0.2.47391 > 192.168.0.10.https: Flags [R], seq 3088549799, win 0, length 0
16:48:17.472667 IP 192.168.0.150.47393 > 192.168.0.2.https: Flags [S], seq 1316556207, win 65535, options [mss 1460,sackOK,TS val 126143512 ecr 0,nop,wscale 9], length 0
16:48:17.472717 IP 192.168.0.2.47393 > 192.168.0.10.https: Flags [S], seq 1316556207, win 65535, options [mss 1460,sackOK,TS val 126143512 ecr 0,nop,wscale 9], length 0
16:48:17.473002 IP 192.168.0.10.https > 192.168.0.2.47393: Flags [S.], seq 1188287718, ack 1316556208, win 28960, options [mss 1460,sackOK,TS val 378390 ecr 126143512,nop,wscale 7], length 0
16:48:17.473017 IP 192.168.0.2.https > 192.168.0.150.47393: Flags [S.], seq 1188287718, ack 1316556208, win 28960, options [mss 1460,sackOK,TS val 378390 ecr 126143512,nop,wscale 7], length 0
16:48:17.476317 IP 192.168.0.150.47393 > 192.168.0.2.https: Flags [R], seq 1316556208, win 0, length 0
16:48:17.476343 IP 192.168.0.2.47393 > 192.168.0.10.https: Flags [R], seq 1316556208, win 0, length 0