8 votes

How can I redirect outbound traffic to another ip using iptables

I've used rules like the following to redirect OUTPUT traffic intended for a given host:port to another host:port. (It was to emulate an embedded system (with fixed addresses) in a VM cluster.) ...
user avatar
  • 81
4 votes
Accepted

What does iptables -j REDIRECT *actually* do to packet headers?

Take a look at this answer: How does a transparent SOCKS proxy know which destination IP to use? Quotation: iptables overrites the original destination address but it remembers the old one. The ...
user avatar
4 votes
Accepted

Use the LANs of one server to access the LAN of another

That's a very basic networking thing: If you want to connect different LAN segments, you need a router. You don't need NAT, you don't need iptables, you just route, plain and simple. For some reason ...
user avatar
  • 29k
3 votes
Accepted

Setting up a development environment with Iptables

To redirect access to from 127.0.0.2:80 to 127.0.0.1:3000, you could do something like: # iptables -t nat -A PREROUTING -p tcp -d 127.0.0.2 \ --dport 80 -j REDIRECT --to-port 3000 # iptables -t nat ...
user avatar
  • 24.8k
3 votes

Use the LANs of one server to access the LAN of another

From the looks of it you're describing a NAT. A NAT (Network Address Translation) is where traffic from one network (LAN) is masqueraded as coming from another server (WAN) which typically sits in ...
user avatar
  • 346k
3 votes
Accepted

Setting up UDP packets to two different destinations using iptables and PREROUTING

Simple userland tools First I would recommend using a dedicated tool running on server D that will listen for UDP packets, and will send a copy twice, one for A and one for B. This could be done for ...
user avatar
  • 25k
3 votes
Accepted

Iptables not working as I expect: response package not DNATed as expected with DNAT in PREROUTING

iptables nat tables are only traversed for the first packet of a (psuedo-)connection. Later packets are mapped (or left alone) according to the mappings established by the first packet.
user avatar
  • 3,910
2 votes
Accepted

Is it possible to redirect a local port to a LAN port?

Why don't you make Flask to listen on all public IPs. http://flask.pocoo.org/docs/0.10/quickstart/#a-minimal-application Externally Visible Server If you run the server you will notice that ...
user avatar
  • 1,271
2 votes

iptables rules apply with delay

Block it in the OUTPUT rule except to your IP too. iptables -I FORWARD -s 192.168.43.51 ! -d 192.168.43.1 -j DROP iptables -I FORWARD -m state --state ESTABLISHED,RELATED -s 192.167.43.51 ! -d 192....
user avatar
2 votes
Accepted

iptables ports redirect does not work

As @msp9011 and @user4556274 attempted to describe, you need to make your server listen to the "any address" instead of the "127.0.0.1" address. So depending on your webserver software, you change the ...
user avatar
  • 1,059
2 votes
Accepted

iptables: transparent tcp traffic proxy

This is a translation of my comment into a response. The rules should be adjusted to rely on an outbound MASQUERADE of source port to handle return packets. Thus, outgoing packets should be DNAT-ed ...
user avatar
2 votes

IPtables UDP port forward not working

If your packets are generated locally, they enter the OUTPUT chain. In that case, you could add a -j REDIRECT in the OUTPUT chain, in the nat table. If the inbound packets are non-local, then ...
user avatar
2 votes
Accepted

Port forwarding with iptables and firejail sandbox

I made it work by changing the FORWARD rule by: iptables -A FORWARD -o my_br0 -j ACCEPT iptables -A FORWARD -i my_br0 -j ACCEPT The whole list of commands is now: # Create interface sysctl -w net....
user avatar
  • 51
2 votes

Local port forwarding using iptables is not working

Local forwarding of packets different port doesn't pass through PREROUTING chain. They follow the OUTPUT chain. Changing the chain from PREROUTING to OUTPUT works. sudo iptables -t nat -A OUTPUT -p ...
user avatar
  • 31
1 vote
Accepted

iptables - Drop NAT rules based on rule/name, NOT rule number

Given any rule with -I (insert) or -A (append), you can repeat the rule definition with -D to delete it. For your particular example, this will delete the first matching rule in the OUTPUT chain for ...
user avatar
  • 90.3k
1 vote
Accepted

Changing `iptables` rules by `MAC` address

Is there any way to check the existence of these rules before writing them again? Or delete them before you do? You can use -C option for iptables. Check man iptables for more information. I think a ...
user avatar
  • 311
1 vote

IPtables UDP port forward not working

Try this: iptables -t nat -I PREROUTING --src 0/0 --dst {server-ip-address} -p udp --dport 514 -j REDIRECT --to-ports 9901 Replace {server-ip-address} with your servers ip-address (in most cases it's ...
user avatar
1 vote
Accepted

Where does the packet cloned by iptables-mod-tee go after cloning?

The packet cloned through TEE, is set to be untracked by conntrack, prevented from being duplicated again, and emitted through the local output part of the routing stack, so first seen by raw/OUTPUT (...
user avatar
  • 25k
1 vote

Forward all traffic to a socks5 proxy port

First thing: the SOCKS proxy also has to be able to work in some kind of transparent mode (ie: it won't receive a request using the SOCKS protocol but has to handle it anyway using side band ...
user avatar
  • 25k
1 vote

iptables: Change destination-IP of TEE'd packets

I solved this by adding the below iptable rule to the machine where the cloned packet is sent to: sudo iptables -t nat -A PREROUTING -p udp --dport 9003 -j NETMAP --to xx.xx.xxx.xx What this does, ...
user avatar
  • 111
1 vote
Accepted

How to setup ipables to redirect ports when the linux server has two IP addresses

iptables -t nat -A PREROUTING -p tcp -m tcp -d 198.xxx.xxx.14 --dport 80 -j REDIRECT --to-ports 8080 iptables -t nat -A PREROUTING -p tcp -m tcp -d 198.xxx.xxx.14 --dport 443 -j REDIRECT --to-ports ...
user avatar
  • 68.2k
1 vote

Maintain destination port of TCP packets after leaving through another local port

First, NAT in linux is stateful. Meaning you don't need an outbound and an inbound rule. When traffic comes back in that was NATed outbound, linux will automatically un-NAT that return traffic. ...
user avatar
  • 67.6k
1 vote
Accepted

How to Redirect marked packets on multiple ports to one IP Address

Understanding Your Rules The first step in understanding how your firewall rules work is, like in most things, to check the man page (man iptables). In the man page you will find: -m, --match match ...
user avatar
  • 4,200
1 vote
Accepted

Linux Router for One Application using iptables

I think all you are missing is on the router: iptables -t nat -A POSTROUTING -j MASQUERADE
user avatar
1 vote
Accepted

Apache VirtualHost redirect 302 (cyclic link)

Obviously RewriteRule matching anything causes the loop. Disable it. If you want to simply redirect http://haustor.org/ to http://cpt.haustor.org/, declare <VirtualHost> for each virtual host. ...
user avatar
  • 11.5k
1 vote

IPTables redirect all UDP packets including ESTABLISHED

I have two completely different methods to solve this problem: iptables with conntrack zones Contrack zones allow multiple conntrack instances (per network namespace). By adding an orig-zone tag to ...
user avatar
  • 25k
1 vote
Accepted

How can I redirect http traffic to an absolute link path with iptables

You can't do this with iptables alone. You could use iptables for the network redirect, and then a webserver vHost to redirect the URL from 192.168.2.19/* to 192.168.2.15:6969/test.js/* (or whatever)...
user avatar
  • 90.3k
1 vote
Accepted

How to redirect web traffic to specific host with iptables

Can you try this setup: iptables -t nat -A INPUT -p tcp --dport 5000 -j DNAT --to-destination 192.168.2.3:5000 iptables -t nat -A SRCNAT -j MASQUERADE You can see more examples here. It should work, ...
user avatar
1 vote

Is it possible to redirect a local port to a LAN port?

The /etc/hosts file is used for name lookup, not for IP address to IP address redirection. Moreover, if the sandbox is effective, you shouldn't be able to reach the virtual server from the LAN/WLAN ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible