Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'd like to redirect local requests to port which is translated with NAT. I have following rules:

iptables -t nat -A PREROUTING -p tcp --dport 9020 -j DNAT --to 10.0.3.11:80

however request coming from localhost are rejected:

wget http://127.0.0.1:9020
Connecting to 127.0.0.1:9020... failed: Connection refused.

When I'm connecting from any other computer it works. Is there a way how to do this without recompiling kernel with CONFIG_IP_NF_NAT_LOCAL=y? https://wiki.debian.org/Firewalls-local-port-redirection (which seems to be obsolete).

Update:

iptables -L -v -n --line-numbers -t nat:

Chain PREROUTING (policy ACCEPT 26 packets, 3230 bytes)
num   pkts bytes target     prot opt in     out     source            destination    
4       0   0     DNAT      tcp  --  *       *      0.0.0.0/0         0.0.0.0/0   tcp dpt:9020 to:10.0.3.11:80

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source                destination         
1        0     0 MASQUERADE all  --  *       *      10.0.0.0/16           0.0.0.0/0 
share|improve this question
1  
The -i eth0 prevents this rule to be applied to local connections. Just omit it. –  Hauke Laging Feb 4 at 17:23
    
I've already tried this, it doesn't help. –  Tombart Feb 4 at 18:44
1  
It doesn't solve the problem here for me but PREROUTING is wrong in any case. The rule must be put in the OUTPUT chain. PREROUTING is for packets from the outside which arrive at the host. –  Hauke Laging Feb 5 at 1:10
    
You're right, thanks. Write it as an answer and I'll be happy to accept it :) –  Tombart Feb 5 at 10:05
    
Does that solve the problem for you? It didn't for me which is the reason why I did not write this as an answer. –  Hauke Laging Feb 5 at 11:20

1 Answer 1

up vote 2 down vote accepted

Based on @Hauke Laging comments I put together this:

# connections from outside
iptables -t nat -A PREROUTING -p tcp --dport 9020 -j DNAT --to 10.0.3.11:80
# for local connection
iptables -t nat -A OUTPUT -p tcp --dport 9020 -j DNAT --to 10.0.3.11:80

# Masquerade local subnet
iptables -t nat -A POSTROUTING -s 10.0.3.0/16 -j MASQUERADE
iptables -A FORWARD -o lxcbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i lxcbr0 -o eth0 -j ACCEPT
iptables -A FORWARD -i lxcbr0 -o lo -j ACCEPT

where lxcbr0 is interface in 10.0.3.0/16 subnet and eth0 is interface with public IP addrees.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.