Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://)

I am trying to use "Method 1" which uses iptables to redirect traffic from ports 80 and 443 to 8080 and 8443 in order to get rid of the :8080 in the url.

These are the command that the documentation gives:

/sbin/iptables -t nat -I PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 8080
/sbin/iptables -t nat -A OUTPUT -p tcp -d _[server_ip_address|server_ip_address]_ --dport 80 -j  REDIRECT --to-port 8080
/sbin/iptables -t nat -I PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-ports 8443

I think there is something that needs to be changed about the second line, specifically with the section -d _[server_ip_address|server_ip_address]_ - but I'm not sure what. I've read the man page for iptables but am not having any luck.

I tried changing -d _[server_ip_address|server_ip_address]_ to:

-d _[127.0.0.1|127.0.0.1]_ 

and also:

-d _[54.224.121.116|54.224.121.116]_

and also:

-d _[ec2-54-224-112-116.compute-1.amazonaws.com|ec2-54-224-112-116.compute-1.amazonaws.com]_

The errors I'm getting include Bad argument 'REDIRECT' and also

host/network '_127.0.0.1' not found

Can anyone help me spot what I'm doing wrong?

update: I think the redirect will work without the second line, but I'm still not sure what its intended purpose is...

share|improve this question

3 Answers 3

up vote 4 down vote accepted

I think you're simply confused by the broken punctuation on that page. The _ and [ are remnants of some markup, they aren't part of the iptables syntax. Also the | character cannot be used to separate IPs, you need to use , (comma).

/sbin/iptables -t nat -A OUTPUT -p tcp -d 54.224.121.116,54.224.121.116 --dport 80 -j  REDIRECT --to-port 8080
share|improve this answer

As far as I understand, the second rules specifies what to do if you are trying to reach outwards from your server to your server (thus -d) redirecting 80 to 8080. This is needed by because locally generated packages are not handled by PREROUTING (from http://www.docum.org/docum.org/kptd/ und "Updates")

Note: I usually use shorewall as a firewall, so do not consider my answer to be bulletproof nor rainbow-flavoured.

share|improve this answer

fwiw I would actually think about working with mod_proxy_ajp on regular Apache. It sounds like you're trying to get people to not have to type/see :8080 and :8443 at the end of the server name in the URL. mod_proxy_ajp is usually easier for what you're trying to do and if you decide to up the ante later and do some load balancing, it's trivial to do it if you're already in a mod_proxy_ajp setup. This is the setup on one of my production servers:

<Proxy *>
    AddDefaultCharset off
    Order deny,allow
    Allow from all
</Proxy>

ProxyPass         /   ajp://fqdn.for.server:8009/
ProxyPassReverse  /   ajp://fqdn.for.server:8009/

You can put the ProxyPass in a VirtualHost configuration and after that it's pretty much just like configuring any other host (meaning you can configure SSL on port 443 and plaintext on port 80). For a bigger spiel on the whole deal.

Apache+mod_proxy isn't the only way to do this but it's the one I have the most experience with and seems like it would be less work than how you're trying to do it (port forwarding with the firewall).

share|improve this answer
    
I did see ajp on the configuration page as another option - but why run two servers when one will do? –  cwd Mar 22 '13 at 14:22
    
For the reason listed: It's easier than what you're trying and gives you something to build off of if you decide to add more to it later on. It's also not that resource intensive and lets you configure a lot of stuff in one place if you do end up wanting to use httpd for something else. –  Joel Davis Mar 22 '13 at 16:09
    
I think that easier is subjective - per your answer "Apache+mod_proxy isn't the only way to do this but it's the one I have the most experience with" - so yes it may be easier for you. And yes, it is not that resource intensive, but comparatively iptables is going to use even less resources than running apache with a reverse proxy... –  cwd Mar 22 '13 at 22:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.