Suppose I have a network with a server routing all connections from inside the network to the Internet. How can I set up iptables so that instead of routing incoming connections to the Internet, it instead routes them to localhost port 8080. All help is appreciated.
4
-
The problem is that with simple redirection (destination IP address NAT) you will lose the original destination IP address. Do you want to setup a transparent HTTP proxy or should it process other protocols than HTTP too?– pabouk - Ukraine stay strongOct 18, 2013 at 13:14
-
It doesn't matter if its transparent or not– DankMemesOct 18, 2013 at 14:49
-
Redirecting all the traffic to a proxy is a base for transparent proxy :)– pabouk - Ukraine stay strongOct 18, 2013 at 15:54
-
Here's another answer that really helped me out: unix.stackexchange.com/questions/111433/…– Wren T.May 16, 2014 at 4:38
Add a comment
|
3 Answers
sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:8080
-
1don't use bold ....– user218473Oct 18, 2013 at 13:11
-
Thanks! I haven't tried this yet but I suspect what I've been missing is the ip forwarding command. And next time, please use code blocks, not bold. Oct 18, 2013 at 13:16
-
@AlexAntonov please use code blocks. Select your text in edit mode and click the brackets icon. Oct 18, 2013 at 13:18
-
-
5
that can be done with iptables, but only with kernel >= 3.6.
You will have to do:
sysctl -w net.ipv4.conf.all.route_localnet=1
iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to 127.0.0.1:8080
ip_forward is not necessary, because the packet is not forwarded, but if you don't include the sysctl for route_localnet (which works only in kernels >= 3.6), the packet will be dropped by the kernel because it considers it a "martian", coming from the outside and having a destination address of 127.0.0.1
answered Sep 5, 2014 at 9:15
-
-
Did not know about route_localnet. So old school and couldn't figure out why ip_forward wasnt working (suspected it wasn't needed but tried anyway).– dmouratiNov 1, 2016 at 3:38
-
2Make sure you save
net.ipv4.conf.all.route_localnet=1in/etc/sysctl.confotherwise it won't be persistent and after reboot the variable will go back to 0, causing the packet dropped. Then it would be very hard to figure why now everything is not working... it happened to me. ;)– vizMar 12, 2018 at 18:23 -
2Sorry to necro an old question but is there an ipv6 equivalent of
net.ipv4.conf.all.route_localnetfor use withip6tables?– KebianJul 10, 2019 at 2:56 -
1
Reading the debian documentation (maybe works for other distros) I used this to redirect podman/docker ports to localhost:
8080 -> 80
8083 -> 443
#!/bin/bash
# reset iptables rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
# redirect ports
iptables -t nat -I OUTPUT --src 0/0 --dst 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -I OUTPUT --src 0/0 --dst 127.0.0.1 -p tcp --dport 443 -j REDIRECT --to-ports 8083
check it:
curl -k https://localhost
curl https://localhost
