Chapter 6. Masquerading and Source Network Address Translation

最新推荐文章于 2025-07-15 13:02:00 发布
转载 最新推荐文章于 2025-07-15 13:02:00 发布 · 553 阅读 · 0
文章标签：

#translation #network #linux

本文探讨了源网络地址转换(SNAT)与伪装的概念及其在保护内部网络发起连接或流量中的应用。文中还讨论了SNAT与伪装之间的区别以及它们在处理入站流量时可能遇到的问题。

Chapter 6. Masquerading and Source Network Address Translation

Table of Contents

6.1. Concepts of Source NAT
6.1.1. Differences Between SNAT and Masquerading6.1.2. Double SNAT/Masquerading
6.2. Issues with SNAT/Masquerading and Inbound Traffic6.3. Where Masquerading and SNAT Break

Commonly known under a variety of names, SNAT, masquerading or Many-To-One NAT can be part of a solution to protect

Masquerading for connections or traffic initiated from inside a network. Consider reading Chapter 5, Network Address Translation (NAT) for details on handling inbound traffic or connections.

Masquerading has been supported under the linux kernel since before kernel 2.0. The technique of masquerading

nf_nat_masquerade_ipv6.rar_If...
09-23
标题中的“nf_nat_masquerade_ipv6.rar”很可能是一个与Linux网络内核相关的源代码压缩包，特别是涉及网络地址转换（NAT）和IPv6的伪装（Masquerading）。这个功能在Linux中用于将内部IPv6网络的流量通过一个公共...
Network Address Translation配置
12-09
网络地址转换(NAT,Network Address Translation)属接入广域网(WAN)技术，是一种将私有（保留）地址转化为合法IP地址的转换技术，它被广泛应用于各种类型Internet接入方式和各种类型的网络中。原因很简单，NAT不仅完美地解决了lP地址不足的问题，而且还能够有效地避免来自网络外部的攻击，隐藏并保护网络内部的计算机。
Network Address Translation 网络地址转换
weixin_34238633的博客
08-23 347
NAT(Network AddressTranslation)NAT的本意是通过利用较少的公有IP地址来表示大量私有IP地址的方式来降低IP地址空间的耗用速度。NAT术语：CiscoNAT设备将NAT世界划分为内部inside和外部outside两部分，内部网络通常是私有企业或isp，外部网络是公共internet或面向internet的服务提供商。本地地址是内部网络中设备...
F5 GTM DNS 知识点和实验 3 -加速dns解析
cnxhsy的博客
02-17 5043
第三章：加速dns解析 目标： 了解一个请求是如何发送到一个dns资源池中的，并且了解如何监控资源池中成员的健康状态 使用dns缓存对dns请求进行加速 使用dns express进行对dns请求进行加速 智能解析dns请求 加速解析（dns express，dns cache，load balance dns queries） 配置监听器 3.1、Big-IP DNS解析过程 wide ip dns express dns cache dns resolving cache
F5负载均衡配置
Jian Sun_的博客
03-29 2万+
配置实例详解 一、设备环境： F5产品 2、配置会话保持60分钟； 3、配置获取客户端真实IP地址功能（通过x-forwarded-for参数的http头获取）； 三、概念： Node：节点，用过负载的real主机 Pool：池、组，把node节点加入到一个组，对该组做一些局部配置。 Virtualserver：虚拟服务，就是指负载均衡的VIP地址，也是客户端最终访问的负载地址，以及该实例的一些特殊配置等。 下面是F5的操作界面，有关规则操作都【Local Traffic】菜单下。
什么是 SNAT(Source Network Address Translation) Port
2007 年 ~ 2025 年，深耕 SAP 技术 18 年
09-29 1168
在这种情况下，SNAT 端口的操作将把 VPC 实例的私有 IP 地址转换为 NAT 网关的公共 IP 地址及相应端口。若某个内部设备带有 IP 地址 192.168.1.10 请求一个外部网站，其请求的源 IP 地址 (192.168.1.10) 将在通过路由器时被转换为路由器的公共 IP 地址 (203.0.113.1)。这种端口映射就是所谓的 SNAT 端口，它充当了网络地址转换的重要桥梁，把同一公共 IP 地址下的不同内部设备区分开来，确保每个设备都能独立、准确、可靠地与外部服务器通信。
8、Fedora 31 Network Management and Firewall Configuration
a1b2c3d的博客
07-15 44
本文详细介绍了在Fedora 31中进行网络管理和防火墙配置的方法。涵盖了NetworkManager服务的连接配置文件管理、使用nmcli工具创建和修改连接、配置权限以及firewalld防火墙的基本概念和配置方法。同时，还提供了关于网络和防火墙管理的最佳实践，帮助用户更高效和安全地管理Fedora 31系统。
linux带source地址ping,实战经验：Linux Source NAT在Ping场景下的应用
weixin_42297846的博客
05-12 2934
有时候，有这样的一种需求：需要修改IP数据包中的源地址，比如，从某一个主机发送Ping包到另一个主机，需要修改源地址为另一个源(通常，发出Ping请求的主机有多个网卡地址)。为了解决这一需求，Linux下的netfilter组件中有个Source NAT的功能，可以修改IP数据包中的源地址。此功能实际上是通过iptables在POSTROUTING链中添加一条规则，此规则在数据包被最终发送出去之前...
CPU Directed Address Learning and Purging Sometimes it is required to prevent automatic learning from occurring on a port and have a CPU direct the learning instead. The device supports CPU directed learning on a per port basis by setting the port’s LockedPort bit to a one (Port offset 0x0B). When a port is ‘Locked’ all frames received with an SA not found in the address database cause an SA Miss ATU Violation as long as learning is enabled on the port (i.e., the port’s PAV, offset 0x0B, is non-zero). The SA Miss ATU Violation can be set to generate a hardware interrupt—see the ATUProbIntEn bit of the Switch Global Control register (Global 1 offset 0x04). One ATU Violation per port is held in the ATU. Once a violation is captured all subsequent violations are ignored until the first one is serviced by the CPU. Alternatively, frames with unknown SA's can be mirrored to the CPU (using a Policy Mirror - Section 2.1.3). This is done by setting the Mirror SA Miss bit to a one (Port offset 0x0D). The port needs to still be locked (LockedPort = 1) to stop automatic address learning. In this mode the SA Miss interrupts from the ATU can be ignored or masked as the CPU will get the frames instead. The CPU can retrieve the source MAC address and the source port information of the SA Miss Violation by issuing an ATU Get/Clear Violation Data ATUOp (Section 6.3.6). The CPU then decides if the address should be placed into the address database or not. If it should be, the CPU issues a Load ATUOp (Section 6.3.3). If the CPU loads the new address as ‘non-static’, the entry stays in the address database until it ages out. Its age time is determined by the loaded EntryState value 2 . Normally, addresses on Locked ports do not have their age time refreshed, but they can if the port’s RefreshLocked bit is set to a one (Port offset 0x0B). In this case, addresses already present in the address database will be automatically refreshed (i.e., get their EntryState set to 0x7) as long as the association on the address is not changing (i.e., as long as it is not a station move). Learn2All message frames are generated on these automatic refreshes if the Learn2All bit is set to a one (Global 1 offset 0x0A). Learn2All is used to automatically learn addresses cross-chip in cascaded or multi-chip applications. The CPU can receive interrupts from aging addresses when configured for CPU Directed Learning (i.e., the port's LockedPort in Port offset 0x0B = 1) as follows: 1. The EntryState field is described in Section 6.3.1. 2. The Age Time (Global 1, offset 0x0A) determines the age time as well. See Section 1.2.5. MARVELL CONFIDENTIAL - UNAUTHORIZED DISTRIBUTION OR USE STRICTLY PROHIBITED jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co., Ltd. * UNDER NDA# 58686MARVELL CONFIDENTIAL, UNDER NDA# 58686 jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co., Ltd. jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co., Ltd. MARVELL CONFIDENTIAL, UNDER NDA# 58686 Switch Core Functional Description Basic Switch Operation Copyright © 2018 Marvell CONFIDENTIAL Doc. No. MV-S111519-00 Rev. -- August 22, 2018 Document Classification: Proprietary Information Page 47 1.2.5 Automatic Address Aging The address aging process is used to ensure that if a node is disconnected from the network seg- ment, or if it becomes inactive, its entry is removed in a timely manner from the address database. Aging makes room for new active addresses. An address is removed from the database after a pro- grammable amount of time from the last time the address appeared in an ingressing frame’s Source Address. This programmable time is determined by the Age Time bits in the ATU Control register (Global 1 offset 0x0A). The device runs the address aging process continuously (unless disabled by setting the AgeTime field to zeros). Aging is accomplished by a periodic sweep of the address database. The speed of these sweeps determines the aging time. On each aging sweep of the database, the ATU reads each valid entry and updates its age time by decrementing its EntryState field 1 (as long as the entry is not static – see Section 6.3.1). When the EntryState field reaches zero, the entry is considered invalid and purged from the database. The EntryState field will not decrement past 0x1 (i.e., it will not be automatically purged) if the port’s HoldAt1 bit is set (Port offset 0x0B). HoldAt1 is intended to be used with CPU directed Address Learning (Section 1.2.6). A new or just refreshed unicast MAC address has an EntryState value of 0x7 (see Section 1.2.3). A purged or invalid entry has an EntryState value of 0x0. The values from 0x6 to 0x1 indicate the Age time on the unicast MAC address with 0x1 being the oldest. This scheme results in seven age states on an entry allowing the Address Learning’s least recently used replacement process (Section 1.2.3) to be more precise. An address is purged from the database within 1/7th of the programmed AgeTime value making the address’s lifetime interval in the database more accurate as well. 1.2.6 CPU Directed Address Learning and Purging Sometimes it is required to prevent automatic learning from occurring on a port and have a CPU direct the learning instead. The device supports CPU directed learning on a per port basis by setting the port’s LockedPort bit to a one (Port offset 0x0B). When a port is ‘Locked’ all frames received with an SA not found in the address database cause an SA Miss ATU Violation as long as learning is enabled on the port (i.e., the port’s PAV, offset 0x0B, is non-zero). The SA Miss ATU Violation can be set to generate a hardware interrupt—see the ATUProbIntEn bit of the Switch Global Control register (Global 1 offset 0x04). One ATU Violation per port is held in the ATU. Once a violation is captured all subsequent violations are ignored until the first one is serviced by the CPU. Alternatively, frames with unknown SA's can be mirrored to the CPU (using a Policy Mirror - Section 2.1.3). This is done by setting the Mirror SA Miss bit to a one (Port offset 0x0D). The port needs to still be locked (LockedPort = 1) to stop automatic address learning. In this mode the SA Miss interrupts from the ATU can be ignored or masked as the CPU will get the frames instead. The CPU can retrieve the source MAC address and the source port information of the SA Miss Violation by issuing an ATU Get/Clear Violation Data ATUOp (Section 6.3.6). The CPU then decides if the address should be placed into the address database or not. If it should be, the CPU issues a Load ATUOp (Section 6.3.3). If the CPU loads the new address as ‘non-static’, the entry stays in the address database until it ages out. Its age time is determined by the loaded EntryState value 2 . Normally, addresses on Locked ports do not have their age time refreshed, but they can if the port’s RefreshLocked bit is set to a one (Port offset 0x0B). In this case, addresses already present in the address database will be automatically refreshed (i.e., get their EntryState set to 0x7) as long as the association on the address is not changing (i.e., as long as it is not a station move). Learn2All message frames are generated on these automatic refreshes if the Learn2All bit is set to a one (Global 1 offset 0x0A). Learn2All is used to automatically learn addresses cross-chip in cascaded or multi-chip applications. The CPU can receive interrupts from aging addresses when configured for CPU Directed Learning (i.e., the port's LockedPort in Port offset 0x0B = 1) as follows: 1. The EntryState field is described in Section 6.3.1. 2. The Age Time (Global 1, offset 0x0A) determines the age time as well. See Section 1.2.5. MARVELL CONFIDENTIAL - UNAUTHORIZED DISTRIBUTION OR USE STRICTLY PROHIBITED jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co., Ltd. * UNDER NDA# 58686 MARVELL 机密，根据 NDA# 58686 jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co.， Ltd. jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co.， Ltd. MARVELL 机密，根据 NDA# 58686 交换机核心功能说明 基本开关作 版权所有 © 2018 Marvell 机要 文档编号 MV-S111519-00 修订版 -- 八月 22， 2018 文档分类：专有信息 第 47 页 1.2.5 自动地址帐龄 地址老化过程用于确保如果节点与网段断开连接，或者当它变得不活动时，它会及时从地址数据库中删除其条目。老化为新的活跃地址腾出了空间。地址在上次出现在入口帧的源地址中的可编程时间后，将从数据库中删除地址。该可编程时间由 ATU 控制寄存器中的年龄时间位决定（全局 1 失调 0x0A）。 设备连续运行地址老化过程（除非通过将 AgeTime 字段设置为零来禁用）。老化是通过定期扫描地址数据库来完成的。这些扫描的速度决定了老化时间。在数据库的每次老化扫描中，ATU 都会读取每个有效条目，并通过递减其 EntryState 字段来更新其年龄时间（只要条目不是静态的 - 请参阅第 6.3.1 节）。当 EntryState 字段达到零时，该条目将被视为无效并从数据库中清除。如果设置了端口的 HoldAt1 位（端口偏移量 0x0B），则 EntryState 字段将不会递减超过 0x1（即不会自动清除）。HoldAt1 旨在与 CPU 定向地址学习一起使用（第 1.2.6 节）。 新的或刚刚刷新的单播 MAC 地址的 EntryState 值为 0x7（参见第 1.2.3 节）。清除或无效条目的 EntryState 值为 0x0。从 0x6 到 0x1 的值表示单播 MAC 地址上的年龄时间，其中 0x1 是最旧的。该方案导致条目上有七个年龄状态，从而允许更精确地显示地址学习最近使用最少的替换过程（第 1.2.3 节）。在编程的 1/7 范围内从数据库中清除地址 AgeTime 值也使地址在数据库中的生存期间隔更加准确。 1.2.6 CPU 定向地址学习和清除 有时需要防止在端口上发生自动学习，并让 CPU 指导学习。该器件通过将端口的 LockedPort 位设置为 1（端口偏移量 0x0B）来支持每个端口的 CPU 定向学习。当端口处于“锁定”状态时，只要在端口上启用了学习（即端口的 PAV，偏移量 0x0B，非零），所有在地址数据库中未找到 SA 接收的帧都会导致 SA 未命中 ATU 冲突。可以将 SA Miss ATU Violation 设置为生成硬件中断 - 请参阅交换机全局控制寄存器的 ATUProbIntEn 位（全局 1 偏移量 0x04）。每个端口在 ATU 中保留一次 ATU 违规行为。捕获违规后，将忽略所有后续违规，直到 CPU 处理第一个违规。 或者，可以将具有未知 SA 的帧镜像到 CPU（使用策略镜像第 2.1.3 节）。这是通过将镜像 SA 未命中位设置为 1（端口偏移 0x0D）来完成的。端口仍需要锁定（LockedPort = 1）以停止自动地址学习。在此模式下，可以忽略或屏蔽来自 ATU 的 SA 未命中中断，因为 CPU 将获取帧。 CPU 可以通过发出 ATU Get/Clear Violation Data ATUOp（第 6.3.6 节）来检索 SA Miss Violation 的源 MAC 地址和源端口信息。然后 CPU 决定是否应将地址放入地址数据库中。如果应该是，CPU 会发出 Load ATUOp（第 6.3.3 节）。 如果 CPU 将新地址加载为“非静态”，则该条目将保留在地址数据库中，直到它过期。其年龄时间由加载的 EntryState 值确定。通常，锁定端口上的地址不会刷新其年龄时间，但如果端口的 RefreshLocked 位设置为 1（端口偏移量 0x0B），则可以刷新其年龄时间。在这种情况下，地址数据库中已经存在的地址将自动刷新（即，将其 EntryState 设置为 0x7），只要地址上的关联没有改变（即，只要它不是站点移动）。如果 Learn2All 位设置为 1（全局 1 偏移量 0x0A），则在这些自动刷新时生成 Learn2All 消息帧。 Learn2All 用于在级联或多芯片应用中自动学习跨芯片地址。 当配置为 CPU 定向学习（即端口的 LockedPort in Port 偏移量 0x0B = 1）时，CPU 可以接收来自老化地址的中断，如下所示： 1. EntryState 字段在第 6.3.1 节中进行了描述。 2. 年龄时间（全局 1，偏移量 0x0A）也决定了年龄时间。参见第 1.2.5 节。 MARVELL 机密 - 严禁未经授权分发或使用 jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co.， Ltd. * 根据 NDA# 58686 MARVELL CONFIDENTIAL, UNDER NDA# 58686 jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co., Ltd. jl62zm96mul7odd5g98n2ka4wa6e951m5p-kgszdlt5 *TP-Link Technologies Co., Ltd. MARVELL CONFIDENTIAL, UNDER NDA# 58686 Doc. No. MV-S111519-00 Rev. -- CONFIDENTIAL Copyright © 2018 Marvell Page 48 Document Classification: Proprietary Information August 22, 2018 88E6393X/88E6193X/88E6191X Switch Functional Specification  When frames are received that contain an SA in the address database the CPU will receive an ATU Miss Violation interrupt if the EntryState found in the address database on the ingressing frame’s SA is less than 0x4 (and the port’s RefreshLocked bit is cleared to zero). This allows the CPU to refresh the aging entry's EntryState before the entry completely ages out (with an EntryState less than 0x4 the entry is more than ½ aged out.  Regardless if frames are being received or not, if the port’s IntOnAgeOut (interrupt on age out) is enabled, the CPU will receive an Age Out Violation whenever any address associated with the port 1 is aging out (i.e., the entry has an EntryState of 0x1 when aging starts to process the entry). The entry will then either be aged out of the address database (i.e., its EntryState will be cleared to 0x0), or its EntryState value will be held at 0x1 if the port’s HoldAt1 bit is set (Port offset 0x0B). The Hold at 1 feature requires that the CPU purge the entry from the address database, which gives the CPU can control over when and where addresses are removed. In either case, the CPU is informed that a specific MAC address has not been used for the configured Age Time (Global 1 offset 0x0A). If the CPU loads the new address as ‘static’, the entry stays in the address database until the CPU purges it. In this case, the CPU receives no interrupts from this address as long as the address is never used as an SA on a port other than the original source port. If the MAC address is used on a different source port, the CPU can receive an ATU Member Violation interrupt if the IgnoreWrongData bit (Port offset 0x0B) is cleared on the port where the frame just entered the switch. This interrupt may indicate that a station move just occurred or that an end station is masquerading by using another station’s address 总结
最新发布
08-19
ATU（Address Translation Unit）违规中断用于通知CPU在地址学习过程中出现的异常情况，例如当一个已存在的MAC地址尝试在不同端口上再次学习时触发中断。该机制有助于检测网络中的MAC地址冲突或恶意行为。ATU违规...
Docker中的网络详解
仅有的限量版宝藏男孩儿
12-01 3967
本节主要是介绍Docker默认的网络行为，包含创建的默认网络类型以及如何创建用户自定义网络，也会介绍如何在单一主机或者跨主机集群上创建网络的资源需求。 1、默认网络 当你安装了docker，她自动创建了3个网络，可以使用docker network命令来查看 这三个网络被docker内建。当你运行一个容器的时候，可以使用--network参数来指定你的容器连接到哪一个网络。 1）bridge网络 默认连接到docker0这个网桥上。 注：brctl命令在centos中可以使用..
iptables 防火墙（二）- SNAT / DNAT 策略及应用 |（附体系思维导图）
JackTian
10-11 1135
点击上方“杰哥的IT之旅”，选择“设为星标”干货、福利第一时间送达！SNAT 策略概述SNAT全称为：Source Network Address Translation...
SNAT原理
Dadit的博客
07-13 3820
SNAT 策略及应用 • SNAT（Source Network Address Translation，源地址转换）是Linux防火墙的一种地址转换操作，也是iptables命令中的一种数据包控制类型，其作用是根据指定条件修改数据包的源IP地址 SNAT 策略概述 随着internet网络的快速发展，IPv4可支持的可用IP地址资源逐渐匮乏，大部分企业面临着局域网内的主机接入internet的需求，从而通过SNAT策略来解决局域网共享上网的问题，可得以缓解。而解决IPv4地址匮乏的是 （IPv6） 工作原
Linux防火墙实现SNAT与DNAT
悦分享
07-21 926
vi /etc/sysctl.conf 将 net.ipv4.ip_forward=0 修改成 net.ipv4.ip_forward=1。编辑后使用命令让配置马上生效 sysctl -p。开启目标服务器/中转服务器端口**（本例仅限于http服务） python -m SimpleHTTPServer 1024。查询端口**状态 netstat -tupln。
网络地址转换(NAT,Network Address Translation)
踏雪无痕
04-23 1万+
网络地址转换(NAT,Network Address Translation)属接入广域网(WAN)技术，是一种将私有（保留）地址转化为合法IP地址的转换技术，它被广泛应用于各种类型Internet接入方式和各种类型的网络中。原因很简单，NAT不仅完美地解决了lP地址不足的问题，而且还能够有效地避免来自网络外部的攻击，隐藏并保护网络内部的计算机。 网络地址转换（NAT）简介 N
F5 VSOutbound-主动出方向 && IP Forwarding VS
weixin_33858249的博客
12-06 1290
1.配置了全局的SNAT后，VS可以选择fastL4或者ip forwarding，不需要配置Pool member此时服务器可以ping通外网F5上抓包1.没有配置全局SNAT，VS 配置automaproot@(localhost)(cfg-sync Standalone)(Active)(/Common)(tmos)# list ltm virtual outbou...
地址转换的理解配置命令-不作为参考学习之用
weixin_34067049的博客
04-21 336
蓝色字体为注释 加粗下滑为完整命令 在此打问号显示每个命令下可作的操作并做了保留了，作为理解之用。 本例是将10.8.10.0 255.255.255.0 转换为24.17.3.3-24.17.3.9 255.255.255.0 范围内的地址 》》进入全局模式Router#configure terminal Enter configur...
f5 源地址转换
weixin_34280237的博客
07-14 1436
初步接触F5的网络管理员可能会被F5的源地址转换搞迷糊，因为F5有多种情况下需要使用源地址转换，而且源地址转换的方法也有几种，本文就简单叙述一下F5源地址转换。 需要做源地址转换的情况： n内部网络主动发起请求，要求访问外部网络的服务时； n单臂部署F5，外部网络主动发起请求，要求访问内部网络的服务时； 两种情况下，源地址转换的配置方法都是一样的。 配置源...
防火墙之地址转换SNAT DNAT
热门推荐
chengxuyuanyonghu的专栏
03-21 3万+
防火墙之地址转换SNAT DNAT 一、SNAT源地址转换。 1、原理：在路由器后（PSOTROUTING）将内网的ip地址修改为外网网卡的ip地址。 2、应用场景：共享内部主机上网。 3、设置SNAT：网关主机进行设置。  （1）设置ip地址等基本信息。  （2）开启路由功能：  sed -i '/ip-forward/s/0/1/g'
Linux2.4.x中的连接跟踪与地址转换分析
SNAT包括了地址伪装（Masquerading）和源地址转换，适用于外出的数据包，使得内部网络的私有地址可以被外部网络识别。DNAT则涵盖了透明代理和目的地址转换，用于转发到其他目的地的数据包，使得外部网络的请求能够...
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
表情包 代码片
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值