redirect application listening on localhost to listening on external interface / alternative to bindp ( libindp.so )

Question

• imagine a server application that listens on localhost only,
• that has no settings to listen on other interfaces
• one wants to force make it listen on other interfaces such as eth0

bindp (libindp.so) can do that. However, it is not available from Debian repositories, which makes it inconvenient. Hence I am asking, are there any alternatives to bindp to archive the same goal?

Answer 1

This has been asked a dozen of times already and an acceptable answer is to use iptables:

sysctl -w net.ipv4.conf.all.route_localnet=1 
iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to 127.0.0.1:8080

The first command is to allow redirections from the external network to the internal network (which is disabled for security reasons) and the second one is to do the redirection (of course, you have to adapt the ports to your specific case that you have not explained whatsoever).

Another solution could be to use OpenSSH with local port redirection, which allows you to do basically the same thing but without disabling the kernel protection (I'm not detailing this one since the other solution works already).

Depending on the protocol your local-bound service is using, you could also use nginx as a reverse proxy or sshl as a multiplexer.

Finally, socat, stunnel and friends can also be used for this.

The advantage of the iptables solution is that it is in-kernel and therefore faster.

Warning

Since SE is a system where answering precisely is deemed better than trying to actually solve problems, I have tried to answer the question. However given your description which is lacking details, I suspect you are actually in one of these two cases:

1. Either the service can actually be configured to listen to a word-reachable interface but you don't know how, in which case you should have described the service itself and ask how to make it available from the outside.
2. Or the service is really not meant to be word-reachable for technical or security reasons.

But I can't be more precise if I don't know which service it is.

Answer 2

socat tool (Debian package) can help:

socat -d -d TCP4-LISTEN:80,bind=192.168.1.1,fork TCP4:localhost:80

Answer 3

With IPv6 the iptables solution won't work. You can use @Artem's solution instead, like

sudo socat TCP6-LISTEN:80,bind=[2001::beef],fork TCP6:[2001::beef]:8080