Linux下端口转发的三种常见方案及对比详解

# 创建测试目录
mkdir -p ~/port_forwarding_demo
cd ~/port_forwarding_demo

# 安装必要工具（基于ubuntu/debian）
sudo apt update
sudo apt install -y openssh-client openssh-server socat net-tools iptables-persistent netcat

# 验证工具安装
ssh -v
socat -version
iptables --version

#!/bin/bash

# local_forward.sh - ssh本地端口转发示例

# 配置参数
remote_user="your_username"
remote_host="192.168.1.100"
remote_port="8080"
local_port="9000"
ssh_port="22"

echo "正在设置ssh本地端口转发..."
echo "将本地端口 ${local_port} 转发到 ${remote_host}:${remote_port}"

# 检查ssh密钥是否存在，如果不存在则生成
if [ ! -f ~/.ssh/id_rsa ]; then
    echo "生成ssh密钥对..."
    ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -n ""
    echo "请将公钥复制到远程服务器："
    echo "ssh-copy-id ${remote_user}@${remote_host}"
fi

# 执行端口转发命令
echo "启动ssh端口转发，按ctrl+c终止"
ssh -n -l ${local_port}:127.0.0.1:${remote_port} ${remote_user}@${remote_host} -p ${ssh_port}

# 如果连接失败，提示用户
if [ $? -ne 0 ]; then
    echo "ssh连接失败，请检查："
    echo "1. 远程服务器地址和用户名是否正确"
    echo "2. ssh服务是否在远程服务器上运行"
    echo "3. 防火墙设置是否允许ssh连接"
    echo "4. 是否已经将ssh公钥添加到远程服务器"
fi

# 给脚本执行权限
chmod +x local_forward.sh

# 执行端口转发
./local_forward.sh

#!/bin/bash

# remote_forward.sh - ssh远程端口转发示例

# 配置参数
remote_user="your_username"
remote_host="192.168.1.100"
remote_port="9000"
local_port="8080"
local_host="127.0.0.1"
ssh_port="22"

echo "正在设置ssh远程端口转发..."
echo "将远程服务器 ${remote_host} 的端口 ${remote_port} 转发到本地 ${local_host}:${local_port}"

# 检查本地服务是否运行
if ! nc -z ${local_host} ${local_port} 2>/dev/null; then
    echo "警告：本地服务 ${local_host}:${local_port} 可能没有运行"
    echo "请确保在继续之前启动本地服务"
    read -p "是否继续？(y/n): " -n 1 -r
    echo
    if [[ ! $reply =~ ^[yy]$ ]]; then
        exit 1
    fi
fi

# 执行远程端口转发
echo "启动ssh远程端口转发，按ctrl+c终止"
ssh -n -r ${remote_port}:${local_host}:${local_port} ${remote_user}@${remote_host} -p ${ssh_port}

if [ $? -ne 0 ]; then
    echo "ssh远程端口转发失败"
    echo "请检查："
    echo "1. 远程服务器的ssh配置是否允许远程端口转发（gatewayports选项）"
    echo "2. 远程服务器防火墙设置"
fi

#!/bin/bash

# dynamic_forward.sh - ssh动态端口转发示例

# 配置参数
remote_user="your_username"
remote_host="192.168.1.100"
socks_port="1080"
ssh_port="22"

echo "正在设置ssh动态端口转发(socks代理)..."
echo "socks代理将在本地端口 ${socks_port} 启动"

# 启动动态端口转发
echo "启动socks代理服务器，按ctrl+c终止"
ssh -n -d 127.0.0.1:${socks_port} ${remote_user}@${remote_host} -p ${ssh_port}

echo "socks代理已停止"
echo "配置浏览器或其他应用使用socks代理：127.0.0.1:${socks_port}"

#!/bin/bash

# ssh_advanced.sh - ssh高级端口转发配置

# 配置参数
remote_user="your_username"
remote_host="192.168.1.100"
ssh_port="22"
config_file="$home/ssh_forward_config"

# 写入ssh客户端配置
cat > ${config_file} << eof
# ssh端口转发配置
host forward-server
    hostname ${remote_host}
    user ${remote_user}
    port ${ssh_port}
    serveraliveinterval 60
    serveralivecountmax 3
    compression yes
    exitonforwardfailure yes
    localforward 9000 127.0.0.1:8080
    remoteforward 9001 127.0.0.1:3000
    
# 自动重连配置
host auto-reconnect
    hostname ${remote_host}
    user ${remote_user}
    port ${ssh_port}
    serveraliveinterval 30
    serveralivecountmax 10
    tcpkeepalive yes
    exitonforwardfailure yes
eof

echo "ssh配置文件已生成: ${config_file}"
echo "使用方法:"
echo "1. 本地转发: ssh -l 9000:localhost:8080 ${remote_user}@${remote_host}"
echo "2. 远程转发: ssh -r 9001:localhost:3000 ${remote_user}@${remote_host}"
echo "3. 使用配置文件: ssh -f ${config_file} forward-server"

#!/bin/bash

# socat_basic.sh - 基础tcp端口转发

listen_port="9000"
target_host="192.168.1.100"
target_port="8080"
log_file="/tmp/socat_forward.log"

echo "启动socat tcp端口转发..."
echo "监听端口: ${listen_port}"
echo "目标地址: ${target_host}:${target_port}"
echo "日志文件: ${log_file}"

# 检查目标端口是否可达
echo "检查目标服务器连通性..."
if ! nc -z ${target_host} ${target_port} 2>/dev/null; then
    echo "警告: 无法连接到目标服务器 ${target_host}:${target_port}"
    read -p "是否继续？(y/n): " -n 1 -r
    echo
    if [[ ! $reply =~ ^[yy]$ ]]; then
        exit 1
    fi
fi

# 创建日志目录
mkdir -p $(dirname ${log_file})

echo "启动时间: $(date)" >> ${log_file}
echo "启动socat进程..."

# 启动socat端口转发
socat -d -d -lf ${log_file} \
    tcp-listen:${listen_port},fork,reuseaddr \
    tcp:${target_host}:${target_port}

echo "socat进程已停止"
echo "查看详细日志: tail -f ${log_file}"

#!/bin/bash

# socat_ssl.sh - ssl/tls加密端口转发

listen_port="9000"
target_host="192.168.1.100"
target_port="8080"
cert_dir="./ssl_certs"
key_file="${cert_dir}/server.key"
cert_file="${cert_dir}/server.crt"
log_file="/tmp/socat_ssl.log"

echo "设置ssl/tls加密端口转发..."

# 创建ssl证书目录
mkdir -p ${cert_dir}

# 生成自签名ssl证书（如果不存在）
if [ ! -f ${key_file} ] || [ ! -f ${cert_file} ]; then
    echo "生成自签名ssl证书..."
    openssl req -x509 -newkey rsa:4096 -keyout ${key_file} \
        -out ${cert_file} -days 365 -nodes -subj \
        "/c=us/st=state/l=city/o=organization/cn=localhost"
    
    if [ $? -eq 0 ]; then
        echo "ssl证书已生成:"
        echo "密钥文件: ${key_file}"
        echo "证书文件: ${cert_file}"
    else
        echo "ssl证书生成失败"
        exit 1
    fi
fi

echo "启动ssl加密转发..."
echo "监听端口: ${listen_port}"
echo "目标地址: ${target_host}:${target_port}"

# 启动ssl加密转发
socat -d -d -lf ${log_file} \
    openssl-listen:${listen_port},fork,reuseaddr,cert=${cert_file},key=${key_file},verify=0 \
    tcp:${target_host}:${target_port}

echo "ssl转发进程已停止"

#!/bin/bash

# socat_udp.sh - udp端口转发

listen_port="9000"
target_host="192.168.1.100"
target_port="8080"
protocol="udp"

echo "启动${protocol}端口转发..."
echo "监听端口: ${listen_port}"
echo "目标地址: ${target_host}:${target_port}"

# 检查socat版本是否支持udp
socat -h | grep -q "udp4"
if [ $? -ne 0 ]; then
    echo "警告: 当前socat版本可能不完全支持udp功能"
fi

echo "启动udp端口转发进程..."

# 启动udp转发
socat -u udp4-listen:${listen_port},fork,reuseaddr \
    udp4:${target_host}:${target_port} &

pid=$!
echo "udp转发进程已启动 (pid: ${pid})"
echo "按任意键停止转发..."
read -n 1

kill ${pid}
echo "udp转发进程已停止"

#!/bin/bash

# socat_advanced.sh - 高级socat配置

config_dir="./socat_configs"
mkdir -p ${config_dir}

# 创建多个转发配置
cat > ${config_dir}/web_forward.cfg << 'eof'
# web服务转发配置
# 监听端口: 9080 -> 目标: 192.168.1.100:80
socat tcp-listen:9080,fork,reuseaddr tcp:192.168.1.100:80
eof

cat > ${config_dir}/database_forward.cfg << 'eof'
# 数据库服务转发配置  
# 监听端口: 93306 -> 目标: 192.168.1.100:3306
socat tcp-listen:93306,fork,reuseaddr tcp:192.168.1.100:3306
eof

cat > ${config_dir}/ssl_termination.cfg << 'eof'
# ssl终止配置
# 外部ssl -> 内部明文
socat openssl-listen:9443,fork,reuseaddr,cert=./ssl_certs/server.crt,key=./ssl_certs/server.key,verify=0 tcp:192.168.1.100:443
eof

# 创建启动脚本
cat > ${config_dir}/start_all.sh << 'eof'
#!/bin/bash
# 启动所有socat转发

echo "启动所有socat转发服务..."

# 启动web转发
socat tcp-listen:9080,fork,reuseaddr tcp:192.168.1.100:80 &
web_pid=$!
echo "web转发启动 (pid: $web_pid)"

# 启动数据库转发
socat tcp-listen:93306,fork,reuseaddr tcp:192.168.1.100:3306 &
db_pid=$!
echo "数据库转发启动 (pid: $db_pid)"

# 保存pid文件
echo "$web_pid $db_pid" > /tmp/socat_pids.txt

echo "所有服务已启动"
echo "停止所有服务: kill \$(cat /tmp/socat_pids.txt)"
eof

chmod +x ${config_dir}/start_all.sh

echo "高级socat配置已生成在: ${config_dir}"
echo "配置文件:"
ls -la ${config_dir}/

#!/bin/bash

# iptables_basic.sh - 基础iptables端口转发

internal_host="192.168.1.100"
internal_port="8080"
external_port="9000"
external_iface="eth0"  # 根据实际情况修改

echo "配置iptables端口转发..."
echo "外部端口: ${external_port} -> 内部: ${internal_host}:${internal_port}"
echo "网络接口: ${external_iface}"

# 检查是否具有root权限
if [ "$euid" -ne 0 ]; then
    echo "请使用root权限运行此脚本"
    echo "使用方法: sudo ./iptables_basic.sh"
    exit 1
fi

# 启用ip转发
echo "启用ip转发..."
echo '1' > /proc/sys/net/ipv4/ip_forward
sysctl -w net.ipv4.ip_forward=1

# 配置端口转发规则
echo "添加iptables规则..."

# 1. 在nat表的prerouting链中添加dnat规则
iptables -t nat -a prerouting -i ${external_iface} -p tcp --dport ${external_port} \
    -j dnat --to-destination ${internal_host}:${internal_port}

# 2. 在nat表的postrouting链中添加snat规则
iptables -t nat -a postrouting -o ${external_iface} -p tcp -d ${internal_host} --dport ${internal_port} \
    -j masquerade

# 3. 在filter表中允许转发的流量
iptables -a forward -i ${external_iface} -o ${external_iface} -p tcp \
    --dport ${internal_port} -d ${internal_host} -j accept
iptables -a forward -i ${external_iface} -o ${external_iface} -p tcp \
    --sport ${internal_port} -s ${internal_host} -j accept

echo "iptables规则配置完成"
echo "当前nat表规则:"
iptables -t nat -l -n -v

echo "当前filter表规则:"
iptables -l forward -n -v

#!/bin/bash

# iptables_persistent.sh - iptables规则持久化

rules_file="/etc/iptables/rules.v4"
backup_dir="./iptables_backup"

echo "配置iptables规则持久化..."

# 检查root权限
if [ "$euid" -ne 0 ]; then
    echo "请使用root权限运行此脚本"
    exit 1
fi

# 创建备份目录
mkdir -p ${backup_dir}
backup_file="${backup_dir}/rules.v4.backup.$(date +%y%m%d_%h%m%s)"

# 备份当前规则
echo "备份当前iptables规则..."
iptables-save > ${backup_file}
echo "规则已备份到: ${backup_file}"

# 安装iptables-persistent（如果未安装）
if ! command -v netfilter-persistent > /dev/null; then
    echo "安装iptables-persistent..."
    apt update
    apt install -y iptables-persistent
fi

# 保存当前规则
echo "保存当前规则到持久化文件..."
iptables-save > ${rules_file}

# 创建系统服务脚本
cat > /etc/systemd/system/iptables-load.service << eof
[unit]
description=load iptables rules
after=network.target

[service]
type=oneshot
execstart=/sbin/iptables-restore < ${rules_file}
execreload=/sbin/iptables-restore < ${rules_file}
remainafterexit=yes

[install]
wantedby=multi-user.target
eof

# 启用服务
systemctl daemon-reload
systemctl enable iptables-load.service

echo "iptables规则持久化配置完成"
echo "规则文件: ${rules_file}"
echo "备份文件: ${backup_file}"
echo "服务状态: systemctl status iptables-load"

#!/bin/bash

# iptables_advanced.sh - 高级iptables转发配置

if [ "$euid" -ne 0 ]; then
    echo "请使用root权限运行此脚本"
    exit 1
fi

config_dir="./iptables_advanced"
mkdir -p ${config_dir}

# 创建端口转发配置函数
create_forward_rule() {
    local name=$1
    local ext_port=$2
    local int_host=$3
    local int_port=$4
    local protocol=${5:-tcp}
    
    cat > ${config_dir}/forward_${name}.sh << eof
# !/bin/bash
# ${name}端口转发配置

echo "配置${name}端口转发..."
echo "外部端口: \${ext_port} -> 内部: \${int_host}:\${int_port}"

# 启用ip转发
echo '1' > /proc/sys/net/ipv4/ip_forward

# 清理旧规则
iptables -t nat -d prerouting -p ${protocol} --dport ${ext_port} -j dnat --to-destination ${int_host}:${int_port} 2>/dev/null
iptables -t nat -d postrouting -p ${protocol} -d ${int_host} --dport ${int_port} -j masquerade 2>/dev/null

# 添加新规则
iptables -t nat -a prerouting -p ${protocol} --dport ${ext_port} \\
    -j dnat --to-destination ${int_host}:${int_port}
iptables -t nat -a postrouting -p ${protocol} -d ${int_host} --dport ${int_port} \\
    -j masquerade

# 允许转发
iptables -a forward -p ${protocol} --dport ${int_port} -d ${int_host} -j accept
iptables -a forward -p ${protocol} --sport ${int_port} -s ${int_host} -j accept

echo "${name}转发规则配置完成"
eof
    
    chmod +x ${config_dir}/forward_${name}.sh
}

# 创建多个转发规则
create_forward_rule "web" "80" "192.168.1.100" "8080"
create_forward_rule "https" "443" "192.168.1.100" "8443"
create_forward_rule "ssh" "2222" "192.168.1.100" "22"
create_forward_rule "database" "3306" "192.168.1.101" "3306"

# 创建管理脚本
cat > ${config_dir}/manage_forwarding.sh << 'eof'
#!/bin/bash
# iptables转发管理脚本

action=${1:-status}

case $action in
    start)
        echo "启动所有端口转发..."
        for script in ${config_dir}/forward_*.sh; do
            if [ -f "$script" ]; then
                echo "执行: $script"
                $script
            fi
        done
        ;;
    stop)
        echo "停止所有端口转发..."
        # 清理nat规则
        iptables -t nat -f prerouting
        iptables -t nat -f postrouting
        iptables -f forward
        echo "所有转发规则已清理"
        ;;
    status)
        echo "当前nat表规则:"
        iptables -t nat -l -n
        echo ""
        echo "当前forward链规则:"
        iptables -l forward -n
        ;;
    save)
        iptables-save > /etc/iptables/rules.v4
        echo "规则已保存"
        ;;
    *)
        echo "使用方法: $0 {start|stop|status|save}"
        exit 1
        ;;
esac
eof

chmod +x ${config_dir}/manage_forwarding.sh

echo "高级iptables配置已生成在: ${config_dir}"
echo "管理脚本: ${config_dir}/manage_forwarding.sh"
echo "使用方法:"
echo "  sudo ${config_dir}/manage_forwarding.sh start   # 启动所有转发"
echo "  sudo ${config_dir}/manage_forwarding.sh stop    # 停止所有转发"
echo "  sudo ${config_dir}/manage_forwarding.sh status  # 查看状态"
echo "  sudo ${config_dir}/manage_forwarding.sh save    # 保存规则"

#!/bin/bash

# performance_test.sh - 三种方案性能对比测试

test_duration=30
target_host="192.168.1.100"
target_port="8080"
local_port="9000"
results_file="./performance_results.txt"

echo "开始性能测试..."
echo "测试时长: ${test_duration}秒"
echo "目标服务: ${target_host}:${target_port}"

# 安装测试工具
if ! command -v ab > /dev/null; then
    echo "安装apache bench..."
    apt update
    apt install -y apache2-utils
fi

# 清理旧结果
> ${results_file}

test_ssh_forwarding() {
    echo "测试ssh端口转发性能..."
    
    # 启动ssh转发后台进程
    ssh -n -l ${local_port}:${target_host}:${target_port} user@${target_host} &
    ssh_pid=$!
    
    # 等待连接建立
    sleep 5
    
    # 运行性能测试
    ab -n 1000 -c 10 http://127.0.0.1:${local_port}/ > /tmp/ssh_test.txt 2>&1
    
    # 提取结果
    requests_per_second=$(grep "requests per second" /tmp/ssh_test.txt | awk '{print $4}')
    time_per_request=$(grep "time per request" /tmp/ssh_test.txt | head -1 | awk '{print $4}')
    
    echo "ssh结果: ${requests_per_second} req/sec, ${time_per_request} ms/req"
    echo "ssh: ${requests_per_second} req/sec, ${time_per_request} ms/req" >> ${results_file}
    
    # 清理
    kill ${ssh_pid}
}

test_socat_forwarding() {
    echo "测试socat端口转发性能..."
    
    # 启动socat转发
    socat tcp-listen:${local_port},fork,reuseaddr tcp:${target_host}:${target_port} &
    socat_pid=$!
    
    sleep 2
    
    # 运行性能测试
    ab -n 1000 -c 10 http://127.0.0.1:${local_port}/ > /tmp/socat_test.txt 2>&1
    
    # 提取结果
    requests_per_second=$(grep "requests per second" /tmp/socat_test.txt | awk '{print $4}')
    time_per_request=$(grep "time per request" /tmp/socat_test.txt | head -1 | awk '{print $4}')
    
    echo "socat结果: ${requests_per_second} req/sec, ${time_per_request} ms/req"
    echo "socat: ${requests_per_second} req/sec, ${time_per_request} ms/req" >> ${results_file}
    
    # 清理
    kill ${socat_pid}
}

test_iptables_forwarding() {
    echo "测试iptables端口转发性能..."
    
    if [ "$euid" -ne 0 ]; then
        echo "需要root权限测试iptables"
        return
    fi
    
    # 配置iptables转发
    ./iptables_basic.sh
    
    # 运行性能测试
    ab -n 1000 -c 10 http://127.0.0.1:${local_port}/ > /tmp/iptables_test.txt 2>&1
    
    # 提取结果
    requests_per_second=$(grep "requests per second" /tmp/iptables_test.txt | awk '{print $4}')
    time_per_request=$(grep "time per request" /tmp/iptables_test.txt | head -1 | awk '{print $4}')
    
    echo "iptables结果: ${requests_per_second} req/sec, ${time_per_request} ms/req"
    echo "iptables: ${requests_per_second} req/sec, ${time_per_request} ms/req" >> ${results_file}
    
    # 清理规则
    iptables -t nat -f
}

# 执行测试
test_ssh_forwarding
test_socat_forwarding
test_iptables_forwarding

echo "性能测试完成"
echo "结果保存在: ${results_file}"
cat ${results_file}

#!/bin/bash

# production_deploy.sh - 生产环境端口转发部署

set -e  # 遇到错误立即退出

echo "生产环境端口转发部署脚本"
echo "================================"

deploy_mode=${1:-"iptables"}  # 默认使用iptables
config_file="./deploy_config.conf"

# 加载配置
if [ -f "${config_file}" ]; then
    source "${config_file}"
else
    # 默认配置
    target_services=(
        "web:80:192.168.1.100:8080"
        "api:8080:192.168.1.101:3000"
        "db:3306:192.168.1.102:3306"
    )
    monitor_port="9090"
    log_dir="/var/log/port_forwarding"
fi

setup_monitoring() {
    echo "设置监控和日志..."
    mkdir -p ${log_dir}
    
    # 安装监控工具
    apt install -y htop iotop nethogs
    
    # 创建监控脚本
    cat > /usr/local/bin/monitor_forwarding.sh << 'eof'
#!/bin/bash
# 端口转发监控脚本

echo "端口转发状态监控"
echo "=================="
echo "当前时间: $(date)"
echo ""

echo "1. 网络连接统计:"
netstat -tulpn | grep -e ":(9000|8080|3306)" | sort
echo ""

echo "2. 系统资源使用:"
ps aux --sort=-%cpu | head -10
echo ""

echo "3. 网络流量:"
nethogs -t -d 1 -c 2 | head -20
eof
    
    chmod +x /usr/local/bin/monitor_forwarding.sh
}

deploy_iptables() {
    echo "部署iptables端口转发..."
    
    # 调用高级配置
    ./iptables_advanced/manage_forwarding.sh start
    
    # 设置定时监控
    (crontab -l 2>/dev/null; echo "*/5 * * * * /usr/local/bin/monitor_forwarding.sh >> ${log_dir}/monitor.log") | crontab -
}

deploy_socat() {
    echo "部署socat端口转发..."
    
    # 创建systemd服务
    for service in "${target_services[@]}"; do
        ifs=':' read -r name ext_port int_host int_port <<< "$service"
        
        cat > /etc/systemd/system/socat-${name}.service << eof
[unit]
description=socat port forwarding for ${name}
after=network.target

[service]
type=simple
execstart=/usr/bin/socat tcp-listen:${ext_port},fork,reuseaddr tcp:${int_host}:${int_port}
restart=always
restartsec=3
user=root
standardoutput=journal
standarderror=journal

[install]
wantedby=multi-user.target
eof
        
        systemctl enable socat-${name}.service
        systemctl start socat-${name}.service
        echo "服务 socat-${name} 已启动"
    done
}

case $deploy_mode in
    "iptables")
        deploy_iptables
        ;;
    "socat")
        deploy_socat
        ;;
    "ssh")
        echo "ssh转发通常用于临时需求，不建议生产环境持久化部署"
        ;;
    *)
        echo "未知的部署模式: $deploy_mode"
        echo "可用模式: iptables, socat, ssh"
        exit 1
        ;;
esac

setup_monitoring

echo "部署完成!"
echo "监控日志: ${log_dir}"
echo "实时监控: /usr/local/bin/monitor_forwarding.sh"

#!/bin/bash

# troubleshooting.sh - 端口转发故障诊断

echo "端口转发故障诊断工具"
echo "======================"

check_connectivity() {
    echo "1. 检查基础连通性..."
    
    if ping -c 3 $1 &> /dev/null; then
        echo "✅ 可以ping通目标主机: $1"
    else
        echo "❌ 无法ping通目标主机: $1"
        return 1
    fi
    
    if nc -z $1 $2 &> /dev/null; then
        echo "✅ 目标服务端口可访问: $1:$2"
    else
        echo "❌ 目标服务端口不可访问: $1:$2"
        return 1
    fi
}

check_forwarding_rules() {
    echo ""
    echo "2. 检查转发规则..."
    
    case $1 in
        "iptables")
            echo "检查iptables规则:"
            iptables -t nat -l -n | grep -e "dnat|redirect"
            iptables -l forward -n | head -10
            ;;
        "socat")
            echo "检查socat进程:"
            ps aux | grep socat | grep -v grep
            netstat -tulpn | grep socat
            ;;
        "ssh")
            echo "检查ssh隧道:"
            ps aux | grep "ssh.*-l\|ssh.*-r" | grep -v grep
            netstat -tulpn | grep ssh
            ;;
    esac
}

check_firewall() {
    echo ""
    echo "3. 检查防火墙设置..."
    
    if command -v ufw > /dev/null; then
        echo "ufw状态:"
        ufw status verbose
    fi
    
    if command -v firewall-cmd > /dev/null; then
        echo "firewalld状态:"
        firewall-cmd --list-all
    fi
    
    echo "iptables默认策略:"
    iptables -l | grep "policy"
}

check_system_resources() {
    echo ""
    echo "4. 检查系统资源..."
    echo "内存使用:"
    free -h
    
    echo ""
    echo "cpu负载:"
    uptime
    
    echo ""
    echo "网络连接数:"
    netstat -an | grep -c established
}

perform_deep_diagnosis() {
    echo ""
    echo "5. 深度诊断..."
    
    echo "内核参数:"
    sysctl net.ipv4.ip_forward
    
    echo ""
    echo "路由表:"
    ip route show
    
    echo ""
    echo "网络接口:"
    ip addr show
    
    echo ""
    echo "连接跟踪:"
    if [ -f /proc/sys/net/netfilter/nf_conntrack_count ]; then
        echo "连接跟踪数: $(cat /proc/sys/net/netfilter/nf_conntrack_count)"
    fi
}

# 执行诊断
target_host=${1:-"192.168.1.100"}
target_port=${2:-"8080"}
forward_type=${3:-"iptables"}

check_connectivity $target_host $target_port
check_forwarding_rules $forward_type
check_firewall
check_system_resources
perform_deep_diagnosis

echo ""
echo "诊断完成!"
echo "根据上述检查结果排查问题"