iptables ports redirect does not work

Question

I am trying to setup a webserver running on localhost:8082 and redirect port 80 to it.

I have done it using the prerouting redirect nat table but it does not seem to work, the packets arrive to the rule, but don't seem to be forwarded on.

Here is what my iptable looks like:

ubuntu@ip-172-31-31-104:~$ sudo iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 6 packets, 348 bytes)
 pkts bytes target     prot opt in     out     source               destination
    6   320 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8082    
    2    84 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 redir ports 8082   
    0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:38204 redir ports 38204

Chain INPUT (policy ACCEPT 14 packets, 752 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 381 packets, 27905 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 381 packets, 27905 bytes)
 pkts bytes target     prot opt in     out     source               destination

My server logs look like this when I do a curl to localhost:8082:

2019/09/16 11:47:36 "GET http://localhost:8082/ping HTTP/1.1" from 127.0.0.1:40386 - 200 87B in 83.384µs

However when I try to do a request from outside, ei using postman, here is what the ip table looks like:

ubuntu@ip-172-31-31-104:~$ sudo iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 6 packets, 348 bytes)
 pkts bytes target     prot opt in     out     source               destination
   11   580 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8082    
    2    84 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 redir ports 8082   
    0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:38204 redir ports 38204

Chain INPUT (policy ACCEPT 19 packets, 1012 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 395 packets, 28995 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 395 packets, 28995 bytes)
 pkts bytes target     prot opt in     out     source               destination

notice the pkts and bytes columns do change, so it seems like the packet does get to the mahcine, but no new logs come in the server logs.

Is there another firewall or level of abstraction I need to worry about ?

Thank you for the help !

UPDATE Here is the netstat, my server is called centrifuge, so it does listen on port 8082

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:8082          0.0.0.0:*               LISTEN      4163/centrifuge
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:52698         0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:38204           0.0.0.0:*               LISTEN      4163/centrifuge
tcp6       0      0 :::22                   :::*                    LISTEN      -
tcp6       0      0 :::8088                 :::*                    LISTEN      26143/pm2-gui slave
tcp6       0      0 ::1:52698               :::*                    LISTEN      -

Answer 1

As @msp9011 and @user4556274 attempted to describe, you need to make your server listen to the "any address" instead of the "127.0.0.1" address. So depending on your webserver software, you change the so called "listen address" to either:

• replace 127.0.0.1 with nothing, i.e. remove the configuration
• replace 127.0.0.1 with 0.0.0.0 which means listen to any IP
• add 0.0.0.0 config to override the default 127.0.0.1
• something along these lines, check your documentation for "listen" or "bind" address and how to make it NOT listen to only local address

If you tell us more about what webserver software you have, we can perhaps assist with more detail on the above procedure.

Nevertheless, when successful, this line in your current netstat output:

tcp        0      0 127.0.0.1:8082          0.0.0.0:*               LISTEN      4163/centrifuge

should look like this when you have successfully updated the config:

tcp        0      0 0.0.0.0:8082            0.0.0.0:*               LISTEN      4163/centrifuge

The documentation quoted by @user4556274 means that if a new connection comes in with an interface that has local IP address 123.456.78.9, then the REDIRECT target will change the destination port to 8082 and the destination host to 123.456.78.9 (i.e. NOT 127.0.0.1). Because your configuration listen only to 127.0.0.1, it will not see packets with any other destination address. Address 0.0.0.0 is special and means it will listen to all addresses.