firewall-cmd实现：

1、启用IP转发

vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

sysctl -p

命令生效

2、修改网卡的zone

firewall-cmd --permanent --zone=external --change-interface=eth0

firewall-cmd --permanent --zone=internal --change-interface=eth1

3、设置IP地址伪装

firewall-cmd --zone=external --add-masquerade --permanent

4、设置NAT规则

firewall-cmd --permanent --direct --passthrough ipv4 -t nat POSTROUTING -o eth0 -j MASQUERADE -s 192.168.100.0/24

5、重载Firewall使配置生效

firewall-cmd --reload

6、端口映射

firewall-cmd --zone=external --add-forward-port=port=1122:proto=tcp:toport=22:toaddr=192.168.100.3 --permanent

firewall-cmd --reload

7、验证：

root@aiker:/mnt/c/Users/aikera# ssh -p 1122 [email protected]

[email protected]'s password: #输入192.168.100.3的密码

[root@aiker03 ~]#

来源于https://www.cnblogs.com/Black-Hawk/articles/10593008.html