1

I have the following IPv4 rules:

  1. iptables -t nat -A PREROUTING -d "server ipv4" -p tcp -m tcp --dport 80 -i eth0 - j DNAT --to-destination 127.0.0.1:55555

  2. iptables -P INPUT ACCEPT

In addition, I have a simple proxy that listens on the localhost address: 127.0.0.1:55555

In IPv4 it is working well.

When I tried to do the same in IPv6:

  1. iptables -t nat -A PREROUTING -d "server ipv6 " -p tcp -m tcp --dport 80 -i eth0 -j DNAT --to-destination [::1]:55555

  2. ip6tables -P INPUT ACCEPT

I can't get it to work!

I was able to make it work with:

  1. --to-destination ["link-local IPv6"]:55555
  2. --to-destination ["Server IPv6"]:55555

When I turn on forwarding and add some log line in filter-table, forward-chain.

  1. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding

  2. ip6tables -I FORWARD -j LOG --log-prefix='[filter FORWARD] '

I can see the packet.

[268332.372177] [filter FORWARD] IN=eth0 OUT=eth0 MAC=be:69:fd:2a:9e:bd:0a:08:f1:46:19:a1:86:df SRC= DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=63 FLOWLBL=0 PROTO=TCP SPT=42082 DPT=55555 WINDOW=28800 RES=0x00 SYN URGP=0

I can see that the OUT interface is "eth0" and not "lo", and the kernel think that the packet is not intended for this server.

I have centOS 7, and I did try this in Ubuntu 16 as well.

  • 1
    Try -j REDIRECT --to 55555 instead of DNAT? – multithr3at3d Jan 1 '18 at 16:42
  • with REDIRECT you cannot redirect to localhost ... – Oren Jan 1 '18 at 19:54
  • 1
    That is not true, REDIRECT does exactly that. "The REDIRECT target is used to redirect packets and streams to the machine itself." frozentux.net/iptables-tutorial/chunkyhtml/x4529.html. Also, it's --to-ports. – multithr3at3d Jan 1 '18 at 23:06
  • I tried with REDIRECT: ip6tables -t nat -A PREROUTING -p tcp -m tcp -d <Server ipv6> --dport 80 -j REDIRECT --to-ports 55555 the result: [filter INPUT] IN=eth0 OUT= MAC=be:69:fd:2a:9e:bd:0a:08:f1:46:59:3d:86:dd SRC=<client IPv6> DST=<Server IPv6> LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=42092 DPT=55555 WINDOW=28800 RES=0x00 SYN URGP=0 . the DST is not ::1 – Oren Jan 2 '18 at 8:45
0

I would suggest to add a fwmark to what you are doing, and add an ip rule to use a special routing table. In that table you just say: route to dev lo. The dnat will take care of the rewrite, the fwmark will take care of the route to lo, so your proxy can answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.