Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want a service to be running on every external port on my system. Since it wouldn't work to start 65535 single instances of that service (I guess...) I thought of using iptables for this.

The service (just a 10 line Python script) is listening on localhost:10000. iptables should now forward every TCP-request on an external port to this local port so that each of these ports seems to be open. I have only few experiences with iptables and no time to read more about this subject, so I cannot quite get this to work.

I tried:

iptables -A PREROUTING -t nat -i eth0 -p tcp -j DNAT --to-destination 127.0.0.1:10000

But when scanning from within the local network all the ports appear filtered, not open. There are no other rules currently active and the policies are all set to ACC

How can I get that right?

Thanks in advance!

share|improve this question
    
Here's a link to an more recent answer: unix.stackexchange.com/questions/111433/… –  Warren T. May 16 at 4:32

2 Answers 2

up vote 3 down vote accepted

Since your polices are ACCEPT, you can use your iptables line with 2 changes:

  1. add destination port range with --dport 1:65535
  2. change the 127.0.0.1 with your interface IP (the IP of eth0)

for example, this line works if your eth0 IP is 192.168.1.10:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1:65535 -j DNAT --to-destination 192.168.1.10:10000

all connections to 192.168.1.10 (to any port) will be redirected to port 10000.

Edit: You can use the REDIRECT target too:

iptables -t nat -A PREROUTING -p tcp --dport 1:65535 -j REDIRECT --to-ports 10000

this still will not help you if you listen to localhost only.

share|improve this answer
    
Works well if the server listens to the external interface. Thanks! Is it possible to perform the redirection to a port on localhost, so I can run the server locally? –  j0ker Jun 23 '12 at 7:12
1  
IIRC the nat table is made to work with external interfaces. If there is a way to redirect to localhost (or in that matter to different interface), it would imply enabling the forwarding (echo 1 > /proc/sys/net/ipv4/ip_forward) and may be nat-ing the forward and backward traffic (or even source route). I do not see the point of doing this, since your service will be accessible on external interfaces. There is no point making it listen to localhost only. –  0xAF Jun 23 '12 at 13:15
    
The point is convenience in writing the server script. My local IP stays the same, whereas the eth0 IP changes with the network. –  j0ker Jun 23 '12 at 13:42
    
Then use the REDIRECT target. See my edited answer. This way you will use one universal iptables line. And your service can listen to "0.0.0.0" (all interfaces), so even if the ip changes, this wont hurt your service. (Edit: please accept the answer if you find it correct.) –  0xAF Jun 23 '12 at 14:16

Here's a link to a more recent answer: http://unix.stackexchange.com/questions/111433/iptables-redirect-outside-requests-to-127-0-0-1/112232

This one really helped me out.

share|improve this answer
    
Rather than linking to a page, which might go away in the future, please summarize your answer here and also provide the link as reference material. –  Kevin Panko May 16 at 5:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.