1

I have the following IPv4 rules:

  1. iptables -t nat -A PREROUTING -d "server ipv4" -p tcp -m tcp --dport 80 -i eth0 - j DNAT --to-destination 127.0.0.1:55555

  2. iptables -P INPUT ACCEPT

In addition, I have a simple proxy that listens on the localhost address: 127.0.0.1:55555

In IPv4 it is working well.

When I tried to do the same in IPv6:

  1. iptables -t nat -A PREROUTING -d "server ipv6 " -p tcp -m tcp --dport 80 -i eth0 -j DNAT --to-destination [::1]:55555

  2. ip6tables -P INPUT ACCEPT

I can't get it to work!

I was able to make it work with:

  1. --to-destination ["link-local IPv6"]:55555
  2. --to-destination ["Server IPv6"]:55555

When I turn on forwarding and add some log line in filter-table, forward-chain.

  1. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

  2. ip6tables -I FORWARD -j LOG --log-prefix='[filter FORWARD] '

I can see the packet.

[268332.372177] [filter FORWARD] IN=eth0 OUT=eth0 MAC=be:69:fd:2a:9e:bd:0a:08:f1:46:19:a1:86:df SRC= DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=63 FLOWLBL=0 PROTO=TCP SPT=42082 DPT=55555 WINDOW=28800 RES=0x00 SYN URGP=0

I can see that the OUT interface is "eth0" and not "lo", and the kernel think that the packet is not intended for this server.

I have centOS 7, and I did try this in Ubuntu 16 as well.

  • 1
    Try -j REDIRECT --to 55555 instead of DNAT? – multithr3at3d Jan 1 '18 at 16:42
  • with REDIRECT you cannot redirect to localhost ... – Oren Jan 1 '18 at 19:54
  • 1
    That is not true, REDIRECT does exactly that. "The REDIRECT target is used to redirect packets and streams to the machine itself." frozentux.net/iptables-tutorial/chunkyhtml/x4529.html. Also, it's --to-ports. – multithr3at3d Jan 1 '18 at 23:06
  • I tried with REDIRECT: ip6tables -t nat -A PREROUTING -p tcp -m tcp -d <Server ipv6> --dport 80 -j REDIRECT --to-ports 55555 the result: [filter INPUT] IN=eth0 OUT= MAC=be:69:fd:2a:9e:bd:0a:08:f1:46:59:3d:86:dd SRC=<client IPv6> DST=<Server IPv6> LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=42092 DPT=55555 WINDOW=28800 RES=0x00 SYN URGP=0 . the DST is not ::1 – Oren Jan 2 '18 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.