家庭实验室通过VPS实现Nginx反向代理的iptables配置问题求助

大家好，我是刚接触Linux和bash的新手，正在搭建自己的家庭实验室（机器A）。我的最终目标是在服务器上部署Nginx，让外部设备（机器C）能访问Docker里的File Browser、Sonarr这类服务，目前我跟着视频教程在操作。

因为我的英国BT路由器没法做端口转发，所以选了一台VPS（机器B）来中转——主要是不想受Cloudflare的带宽限制，也不想用ZeroTier这类工具。

我一直在找合适的iptables端口转发命令，目前试了下面这些：

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 (Machine b) -j DNAT --to-destination x.x.x.x:18880 (machine a)
sudo iptables -t -A POSTROUTING -p tcp x.x.x.x(machine a) --dport 18880 -j SNAT to --to-source x.x.x.x (machine b)
sudo iptables -A FORWARD -p tcp -d x.x.x.x (machine a) --dport 18880 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

我已经做了这些操作：

• 启用了IPv4端口转发
• 清空了nat表
• 一开始启用了ufw，后来发现iptables规则受影响，就把ufw禁用并重置了，现在没有任何ufw规则

不过我遇到了问题：运行prerouting命令后，一开始查看iptables规则没看到这条规则（但后来用iptables-save导出时发现它其实存在了）。现在我不确定这些配置是否正确，希望大家能给我一些建议，毕竟我还是个新手，谢谢大家！

附上我的iptables-save输出（包含所有表）：

# Generated by iptables-save v1.8.4 on Mon Nov  6 20:37:01 2023

*filter

:INPUT DROP [54923:2610101]

:FORWARD DROP [120:5736]

:OUTPUT ACCEPT [402:21052]

:ts-forward - [0:0]

:ts-input - [0:0]

:ufw-after-forward - [0:0]

:ufw-after-input - [0:0]

:ufw-after-logging-forward - [0:0]

:ufw-after-logging-input - [0:0]

:ufw-after-logging-output - [0:0]

:ufw-after-output - [0:0]

:ufw-before-forward - [0:0]

:ufw-before-input - [0:0]

:ufw-before-logging-forward - [0:0]

:ufw-before-logging-input - [0:0]

:ufw-before-logging-output - [0:0]

:ufw-before-output - [0:0]

:ufw-logging-allow - [0:0]

:ufw-logging-deny - [0:0]

:ufw-not-local - [0:0]

:ufw-reject-forward - [0:0]

:ufw-reject-input - [0:0]

:ufw-reject-output - [0:0]

:ufw-skip-to-policy-forward - [0:0]

:ufw-skip-to-policy-input - [0:0]

:ufw-skip-to-policy-output - [0:0]

:ufw-track-forward - [0:0]

:ufw-track-input - [0:0]

:ufw-track-output - [0:0]

:ufw-user-forward - [0:0]

:ufw-user-input - [0:0]

:ufw-user-limit - [0:0]

:ufw-user-limit-accept - [0:0]

:ufw-user-logging-forward - [0:0]

:ufw-user-logging-input - [0:0]

:ufw-user-logging-output - [0:0]

:ufw-user-output - [0:0]

-A INPUT -j ts-input

-A INPUT

-A INPUT -j ufw-before-logging-input

-A INPUT -j ufw-before-input

-A INPUT -j ufw-after-input

-A INPUT -j ufw-after-logging-input

-A INPUT -j ufw-reject-input

-A INPUT -j ufw-track-input

-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

-A FORWARD -j ts-forward

-A FORWARD -j ufw-before-logging-forward

-A FORWARD -j ufw-before-forward

-A FORWARD -j ufw-after-forward

-A FORWARD -j ufw-after-logging-forward

-A FORWARD -j ufw-reject-forward

-A FORWARD -j ufw-track-forward

-A OUTPUT -j ufw-before-logging-output

-A OUTPUT -j ufw-before-output

-A OUTPUT -j ufw-after-output

-A OUTPUT -j ufw-after-logging-output

-A OUTPUT -j ufw-reject-output

-A OUTPUT -j ufw-track-output

-A ts-forward -i tailscale0 -j MARK --set-xmark 0x40000/0xff0000

-A ts-forward -m mark --mark 0x40000/0xff0000 -j ACCEPT

-A ts-forward -s 100.64.0.0/10 -o tailscale0 -j DROP

-A ts-forward -o tailscale0 -j ACCEPT

-A ts-input -s 100.105.39.150/32 -i lo -j ACCEPT

-A ts-input -s 100.115.92.0/23 ! -i tailscale0 -j RETURN

-A ts-input -s 100.64.0.0/10 ! -i tailscale0 -j DROP

-A ts-input -i tailscale0 -j ACCEPT

-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input

-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input

-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input

-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input

-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input

-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input

-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input

-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "

-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "

-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A ufw-before-forward -j ufw-user-forward

-A ufw-before-input -i lo -j ACCEPT

-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny

-A ufw-before-input -m conntrack --ctstate INVALID -j DROP

-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT

-A ufw-before-input -j ufw-not-local

-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT

-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT

-A ufw-before-input -j ufw-user-input

-A ufw-before-output -o lo -j ACCEPT

-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

-A ufw-before-output -j ufw-user-output

-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "

-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN

-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "

-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN

-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN

-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN

-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny

-A ufw-not-local -j DROP

-A ufw-skip-to-policy-forward -j DROP

-A ufw-skip-to-policy-input -j DROP

-A ufw-skip-to-policy-output -j ACCEPT

-A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT

-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT

-A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT

-A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT

-A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT

-A ufw-user-input -p udp -m udp --dport 443 -j ACCEPT

-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "

-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable

-A ufw-user-limit-accept -j ACCEPT

COMMIT

# Completed on Mon Nov  6 20:37:01 2023

# Generated by iptables-save v1.8.4 on Mon Nov  6 20:37:01 2023

*nat

:PREROUTING ACCEPT [23534:1179042]

:INPUT ACCEPT [5148:292118]

:OUTPUT ACCEPT [257:18587]

:POSTROUTING ACCEPT [257:18587]

:ts-postrouting - [0:0]

-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.209:1880

COMMIT

# Completed on Mon Nov  6 20:37:01 2023

备注：内容来源于stack exchange，提问作者Twinkle