Windos10及以上系统实现SNAT功能

package main

import (
    "fmt"
    "net"
    "time"

    "github.com/williamfhe/godivert"
    "github.com/williamfhe/godivert/header"
)

var (
    NETWORK         = 0
    NETWORK_FORWARD = 1

    targetIP = net.ParseIP("192.168.197.135")
    routerIP = net.ParseIP("192.168.197.129")
    unbutuIP = net.ParseIP("192.168.197.130")
)

// inbound -> snat
func snatPacket(wd *godivert.WinDivertHandle, packetChan <-chan *godivert.Packet) {
    for packet := range packetChan {
        if packet.SrcIP().Equal(unbutuIP) && packet.DstIP().Equal(targetIP) && packet.NextHeaderType() == header.ICMPv4 {
            fmt.Println("snat old:" + packet.String())
            packet.SetSrcIP(routerIP)
            fmt.Println("snat new:" + packet.String())
        }

        packet.CalcNewChecksum(wd)
        packet.Send(wd)
    }
}

// outbound -> restore ip
func restorePacket(wd *godivert.WinDivertHandle, packetChan <-chan *godivert.Packet) {
    for packet := range packetChan {
        if packet.SrcIP().Equal(targetIP) && packet.DstIP().Equal(routerIP) && packet.NextHeaderType() == header.ICMPv4 {
            fmt.Println("restore old:" + packet.String())
            packet.SetDstIP(unbutuIP)
            fmt.Println("restore new:" + packet.String())
        }

        packet.CalcNewChecksum(wd)
        packet.Send(wd)
    }
}

func main() {
    postRoutingWinDivert, err := godivert.NewWinDivertHandle("true", uint8(NETWORK_FORWARD))
    if err != nil {
        panic(err)
    }
    defer postRoutingWinDivert.Close()
    forwardPacketChan, err := postRoutingWinDivert.Packets()
    if err != nil {
        panic(err)
    }

    preRoutingwinDivert, err := godivert.NewWinDivertHandle("true", uint8(NETWORK))
    if err != nil {
        panic(err)
    }
    defer preRoutingwinDivert.Close()
    inputPacketChan, err := preRoutingwinDivert.Packets()
    if err != nil {
        panic(err)
    }

    go snatPacket(postRoutingWinDivert, forwardPacketChan)
    go restorePacket(preRoutingwinDivert, inputPacketChan)

    time.Sleep(230 * time.Second)
}

package main

import (
	"fmt"
	"log"
	"net"

	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcap"
)

var (
	device string = `\Device\NPF_{187ABB88-AD26-4B42-92E1-0A12B8FF1E18}`
	err    error
	handle *pcap.Handle

	targetIP = net.ParseIP("192.168.197.135")
	routerIP = net.ParseIP("192.168.197.129")
	unbutuIP = net.ParseIP("192.168.197.130")
)

func main() {
	// 不知道名称得自己先查一下
	// devices, err := pcap.FindAllDevs()
	// if err != nil {
	// 	log.Fatal(err)
	// }
	// for _, device := range devices {
	// 	fmt.Printf("Device Name: %s\n", device.Name)
	// 	fmt.Printf("Description: %s\n", device.Description)
	// 	fmt.Println()
	// }

	// open device capture
	handle, err = pcap.OpenLive(device, 65536, true, pcap.BlockForever)
	if err != nil {
		log.Fatal(err)
	}
	defer handle.Close()

	// only test icmp
	filter := fmt.Sprintf(`((src host %s and dst host %s) or (src host %s and dst host %s)) and icmp`, unbutuIP, targetIP, targetIP, routerIP)
	err = handle.SetBPFFilter(filter)
	if err != nil {
		log.Fatal(err)
	}

	// handle packet
	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	for packet := range packetSource.Packets() {
		var ethLayer layers.Ethernet
		var ipLayer layers.IPv4
		var icmpLayer layers.ICMPv4
		var payload gopacket.Payload

		parser := gopacket.NewDecodingLayerParser(
			layers.LayerTypeEthernet,
			&ethLayer,
			&ipLayer,
			&icmpLayer,
			&payload,
		)
		foundLayerTypes := []gopacket.LayerType{}

		err := parser.DecodeLayers(packet.Data(), &foundLayerTypes)
		if err != nil {
			continue
		}

		// reject snat packet
		if ipLayer.SrcIP.Equal(unbutuIP) && ipLayer.DstIP.Equal(targetIP) {
			modifyedIpLayer := ipLayer
			modifyedIpLayer.SrcIP = routerIP

			options := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
			buffer := gopacket.NewSerializeBuffer()
			gopacket.SerializeLayers(buffer, options,
				&ethLayer,
				&modifyedIpLayer,
				&icmpLayer,
				payload,
			)
			err := handle.WritePacketData(buffer.Bytes())
			if err != nil {
				fmt.Println("[snat]Failed to send modified packet: ", err)
			}

			fmt.Printf("snat old: %+v\n", packet)
			fmt.Printf("snat new: %+v\n", buffer.Layers())

		} else if ipLayer.SrcIP.Equal(targetIP) && ipLayer.DstIP.Equal(routerIP) {
			modifyedIpLayer := ipLayer
			modifyedIpLayer.DstIP = unbutuIP

			options := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
			buffer := gopacket.NewSerializeBuffer()
			gopacket.SerializeLayers(buffer, options,
				&ethLayer,
				&modifyedIpLayer,
				&icmpLayer,
				payload,
			)
			err := handle.WritePacketData(buffer.Bytes())
			if err != nil {
				fmt.Println("[restore]Failed to send modified packet: ", err)
			}

			fmt.Printf("restore old: %+v\n", packet)
			fmt.Printf("restore new: %+v\n", buffer.Layers())
		}

	}
}