I am trying to setup a webserver running on localhost:8082 and redirect port 80 to it.
I have done it using the prerouting redirect nat table but it does not seem to work, the packets arrive to the rule, but don't seem to be forwarded on.
Here is what my iptable looks like:
ubuntu@ip-172-31-31-104:~$ sudo iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 6 packets, 348 bytes)
pkts bytes target prot opt in out source destination
6 320 REDIRECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 8082
2 84 REDIRECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 redir ports 8082
0 0 REDIRECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:38204 redir ports 38204
Chain INPUT (policy ACCEPT 14 packets, 752 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 381 packets, 27905 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 381 packets, 27905 bytes)
pkts bytes target prot opt in out source destination
My server logs look like this when I do a curl to localhost:8082:
2019/09/16 11:47:36 "GET http://localhost:8082/ping HTTP/1.1" from 127.0.0.1:40386 - 200 87B in 83.384µs
However when I try to do a request from outside, ei using postman, here is what the ip table looks like:
ubuntu@ip-172-31-31-104:~$ sudo iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 6 packets, 348 bytes)
pkts bytes target prot opt in out source destination
11 580 REDIRECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 8082
2 84 REDIRECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 redir ports 8082
0 0 REDIRECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:38204 redir ports 38204
Chain INPUT (policy ACCEPT 19 packets, 1012 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 395 packets, 28995 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 395 packets, 28995 bytes)
pkts bytes target prot opt in out source destination
notice the pkts and bytes columns do change, so it seems like the packet does get to the mahcine, but no new logs come in the server logs.
Is there another firewall or level of abstraction I need to worry about ?
Thank you for the help !
UPDATE Here is the netstat, my server is called centrifuge, so it does listen on port 8082
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:8082 0.0.0.0:* LISTEN 4163/centrifuge
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:52698 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:38204 0.0.0.0:* LISTEN 4163/centrifuge
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::8088 :::* LISTEN 26143/pm2-gui slave
tcp6 0 0 ::1:52698 :::* LISTEN -
man iptables-extensions
on the REDIRECT target: "It redirects the packet to the machine itself by changing the destination IP to the primary address of the incoming interface"