iptables port forwarding

Question

I have a CentOS server with Java/J2EE(Tomcat) installed on TCP port 8080. I have two interfaces, eth0 and lo.

I need to forward all incoming connection on TCP port 80 to 8080.

I tried doing the following which works:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to x.x.x.x:8080
iptables -A INPUT -p tcp -m state --state NEW --dport 8080 -i eth0 -j ACCEPT

where x.x.x.x is the ip associated to the eth0 interface.

This appears to also open port 8080 to the outside world, which I don't want to do. I only want port 80 exposed to the outside world, forwarding all traffic to 8080.

Any help would be appreciated.

Update : The iptables -L looks like below

[root@server admin]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       tcp  --  anywhere             anywhere            state NEW tcp dpt:http 

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
[root@server admin]# 

iptables -t nat --list looks like below

[root@server admin]# iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             anywhere            tcp dpt:http to:x.x.x.x:8080 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
[root@server admin]# ^C

Answer 1

I posted a comment suggesting to set tomcat to listen on 80 or to use apache/nginx as a reverse proxy, which is what I think you should really be doing. But for posterity I will also answer your iptables question.

The problem is that what you're doing isn't DNAT, it's port redirection. Instead of -j DNAT you need -j REDIRECT.

E.g.:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Answer 2

You are using the iptables backwards. The iptables -A INPUT -p tcp -m state --state NEW --dport 8080 -i eth0 -j ACCEPT explicity opens the port to the world. What you need is change the ACCEPT for DROP, then the port will only accept new connections to 80 but not to 8080.

iptables -A INPUT -p tcp -m state --state NEW --dport 8080 -i eth0 -j DROP