iptables: how to allow traffic from redirected port

Question

I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration:

root@localhost:~# iptables -v -L --line-numbers
Chain INPUT (policy DROP 76 packets, 6266 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1       90  8898 ACCEPT     all  --  lo     any     anywhere             anywhere            
2        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http
3     4515 3113K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4858 packets, 587K bytes)
num   pkts bytes target     prot opt in     out     source               destination

and nat table:

root@localhost:~# iptables -L -n -v -t nat
Chain PREROUTING (policy ACCEPT 14 packets, 2288 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8080
    0     0 REDIRECT   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 redir ports 8080

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 841 packets, 53415 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 841 packets, 53415 bytes)
 pkts bytes target     prot opt in     out     source               destination

i can't establish a connection from outside on port 80. What are likely deficiencies?

See [this answer](http://stackoverflow.com/questions/11065124/iptables-redirect-80-to-8080-but-block-public-8080-access/11317891#11317891"). — Abbafei, Oct 08 '13 at 07:27

Rahul Patil · Answer 1 · 2013-07-15T20:56:04.783

3

When User HIT Port 80 Then in iptables it's first check NAT PREROUTING Table then it's checks FILTER Tables, So as per your scenario you need to allow Port 8080 in Filter INPUT chain.

See below Example:

In Filter Table :

iptables -A INPUT -i eth0 -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT

In Nat Table :

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

Above rules is tested with Filter INPUT Policy Drop and it's working.

For Tables Sequence is Below :

Mangle PREROUTING
Nat PREROUTING
mangle INPUT
Filter INPUT

For more details check this page.

edited Jul 15 '13 at 20:56

answered Jul 15 '13 at 20:41

Rahul Patil

24,281
25
80
96

But with this way, port 8080 will be open for outside. i want to open only port 80 – Deniz Jul 16 '13 at 12:38
then just allow Only `ESTABLISHED,RELATED` Connections not `NEW` – Rahul Patil Jul 16 '13 at 12:47
I already added this rule for all ports, look at my question – Deniz Jul 16 '13 at 13:03
hmm interesting... – Rahul Patil Jul 16 '13 at 13:31
if you want specifically block port 8080 New connection then you can block port 8080 in nat prerouting chain eg. `iptables -t nat -I PREROUTING -p tcp --dport 8080 -j REJECT` this is one solution in mind.. I will provide you other solution when I reach my home.. – Rahul Patil Jul 16 '13 at 14:05
it says "reject" is only valid in filter table, not nat. – Deniz Jul 16 '13 at 14:37
have you tried with `DROP` – Rahul Patil Jul 16 '13 at 15:04
The "nat" table is not intended for filtering, the use of DROP is therefore inhibited. – Deniz Jul 16 '13 at 15:15
2

1. Redirect Incoming traffic on Port 8080 to 81 `iptables -t nat -I PREROUTING -p tcp --dport 8080 -j REDIRECT --to-ports 81` 2. Since INPUT chain is DROP then Port 81 will get blocked – Rahul Patil Jul 20 '13 at 07:03

iptables: how to allow traffic from redirected port

1 Answers1

Linked

Related