3.5.3. 创建网络数据包过滤规则
Before assigning any
iptables rules for FTP service, review the information in 第 3.4.1 节 “分配防火墙标记” concerning multi-port services and techniques for checking the existing network packet filtering rules.
Below are rules which assign the same firewall mark, 21, to FTP traffic. For these rules to work properly, you must also use the VIRTUAL SERVER subsection of Piranha Configuration Tool to configure a virtual server for port 21 with a value of
21 in the Firewall Mark field. See 第 4.6.1 节 “子界面” for details.
3.5.3.1. 主动连接规则
主动连接的规则告知内核接受并转发在端口 20（FTP 数据端口）中进入内部浮动 IP 地址的连接。
以下
iptables 命令允许 LVS 路由器接受 IPVS 不了解的真实服务器的外发连接。
/sbin/iptables -t nat -A POSTROUTING -p tcp -s n.n.n.0/24 --sport 20 -j MASQUERADE
In the
iptables command, n.n.n should be replaced with the first three values for the floating IP for the NAT interface's internal network interface defined in the GLOBAL SETTINGS panel of Piranha Configuration Tool.
