8

I have server1 (192.168.0.1:8080) and server2 (192.168.0.2:8765). I need to redirect OUTBOUND traffic from server1 port 8080 to server2 with iptables.

On server1 I set:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A OUTPUT -p tcp --sport 8080 -m owner --uid-owner nobody -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --sport 8080 -m owner --uid-owner tomcat7 -j DNAT --to-destination 192.168.0.2:8765

But it does not work. Without -m and -uid-owner parameters also it is not working.

7
  • What is your goal? Nov 17, 2016 at 1:06
  • Redirect response from tomcat on server1 to server2
    – lala
    Nov 17, 2016 at 6:54
  • But why? What is the point of the client doesn't get a response because you redirected the answer to another server. I still don't understand the goal. Making thousands of stuck tcp connections? Nov 17, 2016 at 6:56
  • 1
    Client gets response from server2. In server2 I must modify payload.How can I redirect outbound traffic from server1 to server2 with iptables? This is the most important question.
    – lala
    Nov 17, 2016 at 7:11
  • 2
    I does not want to explain here the whole project. Accept that it MUST be so. The question is not "why" but "how"?
    – lala
    Nov 17, 2016 at 7:37

1 Answer 1

9

I've used rules like the following to redirect OUTPUT traffic intended for a given host:port to another host:port. (It was to emulate an embedded system (with fixed addresses) in a VM cluster.)

iptables -t nat -A OUTPUT -p tcp -d 192.168.1.101 --dport 1234 -j DNAT --to-destination 192.168.1.102:4321

With the above rule installed if you:

root@archive:~# telnet 192.168.1.101 8888

You will see traffic going to the specified address:

root@archive:~# tcpdump -i eth2 host 192.168.1.102 or host 192.168.1.101
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
21:04:27.953124 IP archive.34496 > 192.168.1.101.8888: Flags [S], seq 2498286032, win 29200, options [mss 1460,sackOK,TS val 961612280 ecr 0,nop,wscale 7], length 0
21:04:28.949044 IP archive.34496 > 192.168.1.101.8888: Flags [S], seq 2498286032, win 29200, options [mss 1460,sackOK,TS val 961612530 ecr 0,nop,wscale 7], length 0

If you:

root@archive:~# telnet 192.168.1.101 1234

You should see traffic going to the translated address:

21:04:50.321139 IP archive.53164 > 192.168.1.102.4321: Flags [S], seq 2332928074, win 29200, options [mss 1460,sackOK,TS val 961617873 ecr 0,nop,wscale 7], length 0
21:04:52.325090 IP archive.53164 > 192.168.1.102.4321: Flags [S], seq 2332928074, win 29200, options [mss 1460,sackOK,TS val 961618374 ecr 0,nop,wscale 7], length 0

The rule in your question specifies a source port (--sport). For OUTBOUND traffic you often won't know the source port - it's normally assigned dynamically as the socket is bound/connected. eg: 34496 and 53164 in the above dumps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .