Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The following iptables configuration work for forwarding port 80 to 8080.

#nat chains

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i bond1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
-A PREROUTING -i bond1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 
COMMIT

#filter chains 

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
COMMIT

However in this setup a user can send a request to port 80 and to port 8080 because of

 -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT

Is there a way to define the ip table rules so that port 80 forwards to port 8080 but port 8080 is not exposed to the outside world?

share|improve this question
add comment

1 Answer 1

I changed my nat prerouting table to redirect packets to port 8080 and 8443 on the external nic to port 77 where the input filter chain will drop them. I am not really sure if this is the best way to do things but it works.

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A PREROUTING -i bond1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
-A PREROUTING -i bond1 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 

#Redirect port 8080,8843 to a port that is blocked this way will appear closed  
-A PREROUTING -i bond1 -p tcp -m tcp --dport 8080 -j REDIRECT --to-ports 77 
-A PREROUTING -i bond1 -p tcp -m tcp --dport 8443 -j REDIRECT --to-ports 77 

COMMIT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.