IPTables - Port to another ip & port (from the inside)

Question

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow:

iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 10.32.25.2:80

This is working like a charm. However, this is working only if I am accessing the website from the outside of the network (at work, at diffrent house, etc). So when I type in mywebsite.com:8080, IPTables do the job correctly and everything is working fine.

Now, the problem I have is, how can I redirect this port from the inside of the network ? My domain name mywebsite.com point to my router (my linux server) from the inside (10.32.25.1) but I want to redirect port 8080 to port 80 on 10.32.25.2 from the inside.

Any clue?

Edit #1

Attempting to help facilitate this question I put this diagram together. Please feel free to update if it's incorrect or misrepresenting what you're looking for.

                                 iptables
                                     |                   .---------------.
    .-,(  ),-.                       v               port 80             |
 .-(          )-.        port 8080________               |               |
(    internet    )------------>[_...__...°]------------->|      NAS      |
 '-(          ).-'     10.32.25.2    ^   10.32.25.1      |               |
     '-.( ).-'                       |                   |               |
                                     |                   '---------------'
                                     |
                                     |
                                   __  _ 
                                  [__]|=|
                                  /::/|_|

Answer 1

I finally found how-to. First, I had to add -i eth1 to my "outside" rule (eth1 is my WAN connection). I also needed to add two others rules. Here in the end what I came with :

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -j DNAT --to 10.32.25.2:80
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to 10.32.25.2:80
iptables -t nat -A POSTROUTING -p tcp -d 10.32.25.2 --dport 80 -j MASQUERADE

Answer 2

You also forgot to mention that package forwarding should be enabled to be able to perform destination NAT. By default, it's usually off, so iptables rules will not work. It can be enabled by issuing:

echo 1 > /proc/sys/net/ipv4/ip_forward

Answer 3

First allow forwarding with

echo 1 > /proc/sys/net/ipv4/ip_forward

Then set iptable rules with

IF=eth1
PORT_FROM=8080
PORT_TO=80
DEST=10.32.25.2
iptables -t nat -A PREROUTING -i $IF -p tcp --dport $PORT_FROM -j DNAT --to $DEST:$PORT_TO
iptables -t nat -A POSTROUTING -p tcp -d $DEST --dport $PORT_TO -j MASQUERADE

You can put these lines into /etc/rc.local for example. Note: since Debian jessie make it executable and enabled the rc.local service via

systemctl enable rc-local.service

Answer 4

First you need to verify that you have the forwarding activated:

cat /proc/sys/net/ipv4/ip_forward

If not 1, run echo 1 > /proc/sys/net/ipv4/ip_forward.

If you want traffic hitting 10.32.25.1 on port 80 and 443 to be forwarded to 10.32.25.2's 80port then you should use the below rule:

iptables -t nat -A PREROUTING -d 10.32.25.1 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 10.32.25.2:80