Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Load Balance set up in Apache httpd:

<VirtualHost *:80>
        DocumentRoot /var/www/html
        ServerName xxx.xxx.xxx.com
        ProxyRequests           Off
        ProxyPreserveHost       On
        ProxyPass / http://xxx.xxx.xxx.xxx:8080/
        ProxyPassReverse / http://xxx.xxx.xxx.xxx:8080/

:8080 is an Apache tomcat application server running on the same host. We have log retention requirements where I work, so I figured making everything apache httpd would make things ideal for analytics.

I was attempting to get all public requests to go through port 80 without breaking any links or bookmarks end users might have. I was going to do that by doing some port translation so that everything looked like it was coming in via port 80 to applications. Without thinking about my load balance above I added the following rules to the nat table:

-A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j REDIRECT --to-ports 80
-A PREROUTING -i eth0 -p tcp -m tcp --dport 8081 -j REDIRECT --to-ports 80

Which I'll admit was pretty dumb of me. Problem is, that I can get to the application either through httpd or directly by going to :8080. The packet count is also going up on each rule so apparently they're being matched against.

My question is this: Why didn't this just create an infinite loop?

It would seem the :8080 requests would get forwarded to httpd which would itself attempt to retrieve them by going over :8080 and thus the circle would continue onwards until I was reformatting my new resume.

share|improve this question
up vote 3 down vote accepted

The answer lies in -i eth0.

Even though you have httpd set to connect to, which I assume is an IP on eth0, the traffic won't actually flow over eth0, it'll use lo instead.

The reason for this is that when routing to any IP the box has on itself, that traffic flows over lo. You can verify this with the following:

ip route get

You will get a line back that contains dev lo, this tells you which interface will be used to send traffic to that address.

For example, on my laptop, I have wlan0 with

$ ip route get
local dev lo  src 
    cache <local> 
share|improve this answer
Thanks for the quick response. – Bratchley May 16 '14 at 18:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.