Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a CentOS server with Java/J2EE(Tomcat) installed on TCP port 8080. I have two interfaces, eth0 and lo.

I need to forward all incoming connection on TCP port 80 to 8080.

I tried doing the following which works:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to x.x.x.x:8080
iptables -A INPUT -p tcp -m state --state NEW --dport 8080 -i eth0 -j ACCEPT

where x.x.x.x is the ip associated to the eth0 interface.

This appears to also open port 8080 to the outside world, which I don't want to do. I only want port 80 exposed to the outside world, forwarding all traffic to 8080.

Any help would be appreciated.

Update : The iptables -L looks like below

[root@server admin]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       tcp  --  anywhere             anywhere            state NEW tcp dpt:http 

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
[root@server admin]# 

iptables -t nat --list looks like below

[root@server admin]# iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             anywhere            tcp dpt:http to:x.x.x.x:8080 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
[root@server admin]# ^C
share|improve this question
add comment

1 Answer

You are using the iptables backwards. The iptables -A INPUT -p tcp -m state --state NEW --dport 8080 -i eth0 -j ACCEPT explicity opens the port to the world. What you need is change the ACCEPT for DROP, then the port will only accept new connections to 80 but not to 8080.

iptables -A INPUT -p tcp -m state --state NEW --dport 8080 -i eth0 -j DROP
share|improve this answer
    
Sorry, your solution doens't work. Would any more information help you provide me a better answer? –  ManiP Sep 20 '13 at 19:29
    
Did you cleared your iptables before adding the rule? sudo iptables -F? –  Braiam Sep 20 '13 at 19:37
    
Yes, cleared everything like in this wiki wiki.centos.org/HowTos/Network/IPTables. –  ManiP Sep 20 '13 at 19:40
    
Could you edit the question and add how sudo iptables -L looks like? –  Braiam Sep 20 '13 at 19:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.