1

I have server1 (192.168.0.1:8080) and server2 (192.168.0.2:8765). I need to redirect OUTBOUND traffic from server1 port 8080 to server2 with iptables.

On server1 I set:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A OUTPUT -p tcp --sport 8080 -m owner --uid-owner nobody -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --sport 8080 -m owner --uid-owner tomcat7 -j DNAT --to-destination 192.168.0.2:8765

But it does not work. Without -m and -uid-owner parameters also it is not working.

  • What is your goal? – Ipor Sircer Nov 17 '16 at 1:06
  • Redirect response from tomcat on server1 to server2 – lala Nov 17 '16 at 6:54
  • But why? What is the point of the client doesn't get a response because you redirected the answer to another server. I still don't understand the goal. Making thousands of stuck tcp connections? – Ipor Sircer Nov 17 '16 at 6:56
  • Client gets response from server2. In server2 I must modify payload.How can I redirect outbound traffic from server1 to server2 with iptables? This is the most important question. – lala Nov 17 '16 at 7:11
  • 1
    I does not want to explain here the whole project. Accept that it MUST be so. The question is not "why" but "how"? – lala Nov 17 '16 at 7:37
2

I've used rules like the following to redirect OUTPUT traffic intended for a given host:port to another host:port. (It was to emulate an embedded system (with fixed addresses) in a VM cluster.)

iptables -t nat -A OUTPUT -p tcp -d 192.168.1.101 --dport 1234 -j DNAT --to-destination 192.168.1.102:4321

With the above rule installed if you:

root@archive:~# telnet 192.168.1.101 8888

You will see traffic going to the specified address:

root@archive:~# tcpdump -i eth2 host 192.168.1.102 or host 192.168.1.101
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
21:04:27.953124 IP archive.34496 > 192.168.1.101.8888: Flags [S], seq 2498286032, win 29200, options [mss 1460,sackOK,TS val 961612280 ecr 0,nop,wscale 7], length 0
21:04:28.949044 IP archive.34496 > 192.168.1.101.8888: Flags [S], seq 2498286032, win 29200, options [mss 1460,sackOK,TS val 961612530 ecr 0,nop,wscale 7], length 0

If you:

root@archive:~# telnet 192.168.1.101 1234

You should see traffic going to the translated address:

21:04:50.321139 IP archive.53164 > 192.168.1.102.4321: Flags [S], seq 2332928074, win 29200, options [mss 1460,sackOK,TS val 961617873 ecr 0,nop,wscale 7], length 0
21:04:52.325090 IP archive.53164 > 192.168.1.102.4321: Flags [S], seq 2332928074, win 29200, options [mss 1460,sackOK,TS val 961618374 ecr 0,nop,wscale 7], length 0

The rule in your question specifies a source port (--sport). For OUTBOUND traffic you often won't know the source port - it's normally assigned dynamically as the socket is bound/connected. eg: 34496 and 53164 in the above dumps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.