Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration:

root@localhost:~# iptables -v -L --line-numbers
Chain INPUT (policy DROP 76 packets, 6266 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1       90  8898 ACCEPT     all  --  lo     any     anywhere             anywhere            
2        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http
3     4515 3113K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4858 packets, 587K bytes)
num   pkts bytes target     prot opt in     out     source               destination     

and nat table:

root@localhost:~# iptables -L -n -v -t nat
Chain PREROUTING (policy ACCEPT 14 packets, 2288 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8080
    0     0 REDIRECT   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 redir ports 8080

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 841 packets, 53415 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 841 packets, 53415 bytes)
 pkts bytes target     prot opt in     out     source               destination 

i can't establish a connection from outside on port 80. What are likely deficiencies?

share|improve this question
    
if possible update output of iptables -L -n -v -t nat –  Rahul Patil Jul 15 '13 at 20:00
    
updated. i can't see any difference –  Deniz Jul 15 '13 at 20:31
    
See this answer. –  Abbafei Oct 8 '13 at 7:27

1 Answer 1

When User HIT Port 80 Then in iptables it's first check NAT PREROUTING Table then it's checks FILTER Tables, So as per your scenario you need to allow Port 8080 in Filter INPUT chain.

See below Example:

In Filter Table :

iptables -A INPUT -i eth0 -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT

In Nat Table :

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

Above rules is tested with Filter INPUT Policy Drop and it's working.

For Tables Sequence is Below :

  1. Mangle PREROUTING
  2. Nat PREROUTING
  3. mangle INPUT
  4. Filter INPUT

For more details check this page.

share|improve this answer
    
But with this way, port 8080 will be open for outside. i want to open only port 80 –  Deniz Jul 16 '13 at 12:38
    
then just allow Only ESTABLISHED,RELATED Connections not NEW –  Rahul Patil Jul 16 '13 at 12:47
    
I already added this rule for all ports, look at my question –  Deniz Jul 16 '13 at 13:03
    
hmm interesting... –  Rahul Patil Jul 16 '13 at 13:31
1  
1. Redirect Incoming traffic on Port 8080 to 81 iptables -t nat -I PREROUTING -p tcp --dport 8080 -j REDIRECT --to-ports 81 2. Since INPUT chain is DROP then Port 81 will get blocked –  Rahul Patil Jul 20 '13 at 7:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.