How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?

Question

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://)

I am trying to use "Method 1" which uses iptables to redirect traffic from ports 80 and 443 to 8080 and 8443 in order to get rid of the :8080 in the url.

These are the command that the documentation gives:

/sbin/iptables -t nat -I PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 8080
/sbin/iptables -t nat -A OUTPUT -p tcp -d _[server_ip_address|server_ip_address]_ --dport 80 -j  REDIRECT --to-port 8080
/sbin/iptables -t nat -I PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-ports 8443

I think there is something that needs to be changed about the second line, specifically with the section -d _[server_ip_address|server_ip_address]_ - but I'm not sure what. I've read the man page for iptables but am not having any luck.

I tried changing -d _[server_ip_address|server_ip_address]_ to:

-d _[127.0.0.1|127.0.0.1]_ 

and also:

-d _[54.224.121.116|54.224.121.116]_

and also:

-d _[ec2-54-224-112-116.compute-1.amazonaws.com|ec2-54-224-112-116.compute-1.amazonaws.com]_

The errors I'm getting include Bad argument 'REDIRECT' and also

host/network '_127.0.0.1' not found

Can anyone help me spot what I'm doing wrong?

update: I think the redirect will work without the second line, but I'm still not sure what its intended purpose is...

Answer 1

I think you're simply confused by the broken punctuation on that page. The _ and [ are remnants of some markup, they aren't part of the iptables syntax. Also the | character cannot be used to separate IPs, you need to use , (comma).

/sbin/iptables -t nat -A OUTPUT -p tcp -d 54.224.121.116,54.224.121.116 --dport 80 -j  REDIRECT --to-port 8080

Answer 2

fwiw I would actually think about working with mod_proxy_ajp on regular Apache. It sounds like you're trying to get people to not have to type/see :8080 and :8443 at the end of the server name in the URL. mod_proxy_ajp is usually easier for what you're trying to do and if you decide to up the ante later and do some load balancing, it's trivial to do it if you're already in a mod_proxy_ajp setup. This is the setup on one of my production servers:

<Proxy *>
    AddDefaultCharset off
    Order deny,allow
    Allow from all
</Proxy>

ProxyPass         /   ajp://fqdn.for.server:8009/
ProxyPassReverse  /   ajp://fqdn.for.server:8009/

You can put the ProxyPass in a VirtualHost configuration and after that it's pretty much just like configuring any other host (meaning you can configure SSL on port 443 and plaintext on port 80). For a bigger spiel on the whole deal.

Apache+mod_proxy isn't the only way to do this but it's the one I have the most experience with and seems like it would be less work than how you're trying to do it (port forwarding with the firewall).

Answer 3

As far as I understand, the second rules specifies what to do if you are trying to reach outwards from your server to your server (thus -d) redirecting 80 to 8080. This is needed by because locally generated packages are not handled by PREROUTING (from http://www.docum.org/docum.org/kptd/ und "Updates")

Note: I usually use shorewall as a firewall, so do not consider my answer to be bulletproof nor rainbow-flavoured.