I want a linux node that I own to be the 'router' -so to speak- for certain packages, REST API packages to be precise.

The whole situation is this, I have made a web-ui program, this program will be a client (call it node-A) , this client will send REST API requests to a server that I own (call it node-B) , but ... I don't want anyone to know anything about node B, not even the domain name, I don't even want them to know that it exists ... the reason is that it's critical to me, and I haven't reached the stage where I'm comfortable with it's security.

So it came to my mind to use another server that I own as intermediate node (call it node-int) , to forward connections from node-A to node-B .

I want the client node-A to make the REST API requests to node-int which will forward the request to node-B , and receive the response from node-B and forward it back to node-A.

The only problem is: I don't know how exactly to do so with iptables, should I use filter table:FORWARD chain, mangle table for altering the packets themselves, or the nat table?

I don't know what is best for the job, that's why I'm asking here in hope for the more experienced to guide me to the best way to do it.


1 Answer 1


You do not do it with IP tables, you do it with http-server configs.

  • Setup two http servers. One visible to the public (your node-int), and another inside your LAN, unaccessible from outside world (your node-B).
  • On the public server you enable proxy and define which URLs are processed right here, which goes to the node-B, which goes to some other server.

The exact config statement depends on the http server of course, so here is how it is done on Apache: https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html

Other http servers would have something similar.

  • is there NO WAY to do it with iptables !? Feb 13 at 21:58
  • 1
    With ip tables you will do all or nothing. With IP forwarding, any request which comes to an intermediate server is forwarded to a protected one. Regardless of is it a REST API request or static page or some SOAP request. So if you are talking about REST - you should go with proxy http server. IP forwarding can be useful if your "intermediate" server has several in-LAN servers separated by port on the intermediate. Possible, but it is a different level - the one where any talks about REST loose its meaning.
    – White Owl
    Feb 14 at 2:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .