0

I will filter inbound traffic with iptables.

I have 2 goals.

a) Allow HTTPS inbound at port 443.

b) Redirect port 443 to process listening port on 9443.

Not sure about the processing of that 2 rules.

Do I need to set my INPUT rule to ACCEPT inbound HTTPS to port 443 or 9443?7

Depends on if redirection is done before or after I think.

1
  • you should be able to test that :) put log rules for both ports and see what you catch :)
    – ilkkachu
    Feb 2 at 13:20

1 Answer 1

1

The PREROUTING chain in the nat table handles the redirection for you:

iptables -t nat -I PREROUTING --protocol tcp --dport 443 --jump REDIRECT --to-port 9443

Then the INPUT chain (implicitly in the filter table) handles permitted traffic:

iptables -I INPUT --protocol tcp --dport 9443 --jump ACCEPT

Notice that the result is that the service listening on port 9443 will effectively accept traffic on both its true port 9443 and the alternative 443.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .