0

I currently have the following iptables rules:

iptables-save -c
# Generated by iptables-save v1.4.7 on Wed Oct 21 13:24:24 2020
*nat
:PREROUTING ACCEPT [5163:300376]
:POSTROUTING ACCEPT [35:11935]
:OUTPUT ACCEPT [30:11635]
[12:760] -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 10090 
[5:300] -A OUTPUT -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.5.67:10090 
COMMIT
# Completed on Wed Oct 21 13:24:24 2020
# Generated by iptables-save v1.4.7 on Wed Oct 21 13:24:24 2020
*filter
:INPUT ACCEPT [24586:5363323]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [41609:7761875]
[13520:2056828] -A INPUT -p tcp -m tcp --dport 10090 -j ACCEPT 
[0:0] -A INPUT -p tcp -m tcp --dport 18080 -j ACCEPT 
[0:0] -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
COMMIT
# Completed on Wed Oct 21 13:24:24 2020

It is working as expected for all incoming traffic, but it is also sending traffic on this server to the DNAT address:port. How can I change this so that all incoming traffic is DNAT as above, but that will also allow me to do curl to http sites and not sent to the the DNAT address.

Thank you Kobus

2
  • 1
    Sorry about that. Hope this helps.
    – Kobus
    Oct 21, 2020 at 12:27
  • Hum, now I feel there's missing the precise description of "working as expected". What's the expected outcome? Does 172.16.5.67 belong to the host? Is this setting up a kind of transparent proxy? Is it running on the same host? If so are you complaining that the proxy is forced to be proxied by itself? etc. Even if not so, could you clarify the goal? Because I don't see the point of the nat/OUTPUT rule.
    – A.B
    Oct 21, 2020 at 14:16

1 Answer 1

0

It's ok, I have sorted the issue. I needed the PREROUTING rule, but to make output http work, all I had to do was to remove the OUTPUT rule.

The proper way it was supposed to work is for all external connections to be DNAT to ip:port. It did that not only for all incoming connections, but also for all outgoing connections. The incoming is fine, the outgoing was not.

1
  • And as you suggested, the OUTPUT rule was not needed.
    – Kobus
    Oct 21, 2020 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .