Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote host and port.

Can I achieve this using the NAT and pre-routing functions of iptables?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Try this iptables rule:

$ sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination IP:80

The above says to:

  • Add the following rule to the NAT table (-t nat).
  • This rule will be appended (-A) to the outbound traffic (OUTPUT).
  • We're only interested in TCP traffic (-p tcp).
  • We're only interested in traffic who's destination port is 80 (--dport 80).
  • When we have a match, jump to DNAT (-j DNAT).
  • Route this traffic to some other server's IP @ port 80 (--to-destination IP:80).

What's DNAT?

DNAT
    This target is only valid in the nat table, in the PREROUTING and OUTPUT 
    chains, and user-defined chains which are only called from those chains.
    It specifies that the destination address of the packet should be modified 
    (and all future packets in  this  connection will also be mangled), and
     rules should cease being examined.

References

share|improve this answer
    
thanks for that but it does not seem to work. I have however since found this that does work. –  pjf Aug 8 '13 at 6:20
    
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination xx.xx.xx.xx:3128 –  pjf Aug 8 '13 at 6:21
    
Is that because this is locally and not through a gateway? your SNAT would work through a gateway? –  pjf Aug 8 '13 at 6:22
    
@pjf - I believe so. I've updated my answer. –  slm Aug 8 '13 at 6:25
    
@pjf - I found both rules and was in the process of updating my answer with both. I wasn't sure which situation you were in though. –  slm Aug 8 '13 at 6:30
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.