Python 3.7中的端口地址转发/Nat函数

我目前正在用python编写防火墙。 此防火墙必须能够从白名单中判断是否允许流通过

防火墙的目的是在正确的端口上请求它以获得请求的服务。 例如，如果您想访问此防火墙后面的web服务器，只需请求端口80或443上的防火墙，防火墙将根据白名单将数据包转发到正确的机器。对用户来说，一切都必须是透明的

目前，为了解决这个问题，我使用scapy嗅探数据包并传输它们。 但是对于一个简单的HTTP通信（在TCP中），没有任何东西可以工作，UDP和ICMP也是如此

我认为我的问题来自这样一个事实：我使用scapy嗅探数据包并重新传输它们，而我不使用线程。 我想知道是否有人已经做了类似的事情，如果你有任何建议，哪些模块使用

我将尽可能详细地介绍我的代码，让您了解它是如何工作的

首先是main（），此函数嗅探数据包并确定数据包是来自外部还是内部。 根据这些参数，它确定将要处理的数据包发送到哪个其他功能

def main():

    test = 0
    buffer = []

    # INFINITE LOOPS FOR THE MOMENT #
    while(test<1000):

        # SNIFFING PACKET ON THE EXTERNAL AND INTERNAL INTERFACE #
        packet = sniff(filter="ip",iface=["ens192","InternalInterface"],count=1)

        if(packet):

            PacketContent = packet[0]
            IpDestination = PacketContent[IP].dst
            IpDestination = str(IpDestination)
            IPSource = PacketContent[IP].src
            IPSource = str(IPSource)

    # GETTING THE IP AND MASK OF THE INBOUND PACKET #
            LocalIp = ipaddress.ip_network(IfIp+"/"+Mask,strict = False)
            NetworkIp = ipaddress.ip_network(IpDestination+"/"+Mask,strict = False)

    # GETTING THE IP AND MASK OF THE EXTERNAL NETWORK INTERFACE OF THE FIREWALL #
            IfIp = ni.ifaddresses('ens192')[ni.AF_INET][0]['addr']
            Mask = ni.ifaddresses('ens192')[ni.AF_INET][0]['netmask']

    # GETTING THE IP AND MASK OF THE INTERNAL NETWORK INTERFACE OF THE FIREWALL #
            IfIp2 = ni.ifaddresses('InternalInterface')[ni.AF_INET][0]['addr']
            Mask2 = ni.ifaddresses('InternalInterface')[ni.AF_INET][0]['netmask']

    # GETTING THE NETWORK IP OF PACKET AND OF INTERNAL INTERFACE #
            LocalIp2 = ipaddress.ip_network(IfIp2+"/"+Mask2,strict = False)
            IPSource = ipaddress.ip_network(IPSource+"/"+Mask,strict = False)

    # IF A PACKET IS DESTINATED FOR THE ADDRESS OF THE EXTERNAL FIREWALL INTERFACES #
            if(IfIp == IpDestination):
                if(PacketContent[TCP].dport == 22):
                    main()
                print("Forwarding "+ IpDestination + " to IN")
                buffer =  ForwardingPort(PacketContent,buffer)

    # IF A PACKET IS DESTINATED FOR THE ADDRESS OF THE INTERNAL FIREWALL INTERFACES #
            elif(IPSource == LocalIp2):
                PacketContent.show()
                print("Forwarding  "+ str(IPSource) + " to OUT")
                buffer = BufferPort(PacketContent,buffer)

现在，如果数据包来自防火墙内部，则将调用函数BufferPort

def BufferPort(Packet,buffer):

    # GETTING THE PORT DESTINATION OF THE PACKET #
    Dport = str(Packet[IP].dport)

    # CHECKING IF THE TEMPORARY SOCKET IS ON THE BUFFER LIST #
    for yo in buffer:

        print("checking buffer")
        lo = lo + 1

        # IF THE TEMPORARY SOCKET IS IN, REPLACE IP BY THE EXTERNAL FIREWALL INTERFACE IP AND RECALCULATE PACKET CHECKSUM #
        if(Dport in yo):

            ipDestBuff = yo.split(":")[1]
            ipDestBuff = ipDestBuff.replace(" ","")
            ipDestBuff = ipDestBuff.replace("\n","")

            Packet[IP].dst = ipDestBuff
            Packet[IP].src = "192.168.1.81"

            del Packet[IP].chksum
            del Packet[TCP].chksum
            Packet.show2()

            sendp(Packet,iface="ens192")
            buffer[lo] = ""
    return buffer

---

多谢各位

没有这种类型的硬件辅助将大大降低吞吐量。这是一个小小的个人项目。所以我不会把vice推得太远：）没有这种类型的硬件辅助将大大降低吞吐量。这是一个小小的个人项目。所以我不会把恶习推到那么远：）

def BufferPort(Packet,buffer):

    # GETTING THE PORT DESTINATION OF THE PACKET #
    Dport = str(Packet[IP].dport)

    # CHECKING IF THE TEMPORARY SOCKET IS ON THE BUFFER LIST #
    for yo in buffer:

        print("checking buffer")
        lo = lo + 1

        # IF THE TEMPORARY SOCKET IS IN, REPLACE IP BY THE EXTERNAL FIREWALL INTERFACE IP AND RECALCULATE PACKET CHECKSUM #
        if(Dport in yo):

            ipDestBuff = yo.split(":")[1]
            ipDestBuff = ipDestBuff.replace(" ","")
            ipDestBuff = ipDestBuff.replace("\n","")

            Packet[IP].dst = ipDestBuff
            Packet[IP].src = "192.168.1.81"

            del Packet[IP].chksum
            del Packet[TCP].chksum
            Packet.show2()

            sendp(Packet,iface="ens192")
            buffer[lo] = ""
    return buffer