7

I want a service to be running on every external port on my system. Since it wouldn't work to start 65535 single instances of that service (I guess...) I thought of using iptables for this.

The service (just a 10 line Python script) is listening on localhost:10000. iptables should now forward every TCP-request on an external port to this local port so that each of these ports seems to be open. I have only few experiences with iptables and no time to read more about this subject, so I cannot quite get this to work.

I tried:

iptables -A PREROUTING -t nat -i eth0 -p tcp -j DNAT --to-destination 127.0.0.1:10000

But when scanning from within the local network all the ports appear filtered, not open. There are no other rules currently active and the policies are all set to ACC

How can I get that right?

Thanks in advance!

Improve this question
1

2 Answers 2

Reset to default
5

Since your polices are ACCEPT, you can use your iptables line with 2 changes:

  1. add destination port range with --dport 1:65535
  2. change the 127.0.0.1 with your interface IP (the IP of eth0)

for example, this line works if your eth0 IP is 192.168.1.10: 

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1:65535 -j DNAT --to-destination 192.168.1.10:10000

all connections to 192.168.1.10 (to any port) will be redirected to port 10000.

Edit: You can use the REDIRECT target too:

iptables -t nat -A PREROUTING -p tcp --dport 1:65535 -j REDIRECT --to-ports 10000

this still will not help you if you listen to localhost only.

Improve this answer
5
  • Works well if the server listens to the external interface. Thanks! Is it possible to perform the redirection to a port on localhost, so I can run the server locally?
    – j0ker
    Jun 23, 2012 at 7:12
  • 1
    IIRC the nat table is made to work with external interfaces. If there is a way to redirect to localhost (or in that matter to different interface), it would imply enabling the forwarding (echo 1 > /proc/sys/net/ipv4/ip_forward) and may be nat-ing the forward and backward traffic (or even source route). I do not see the point of doing this, since your service will be accessible on external interfaces. There is no point making it listen to localhost only.
    – 0xAF
    Jun 23, 2012 at 13:15
  • The point is convenience in writing the server script. My local IP stays the same, whereas the eth0 IP changes with the network.
    – j0ker
    Jun 23, 2012 at 13:42
  • Then use the REDIRECT target. See my edited answer. This way you will use one universal iptables line. And your service can listen to "0.0.0.0" (all interfaces), so even if the ip changes, this wont hurt your service. (Edit: please accept the answer if you find it correct.)
    – 0xAF
    Jun 23, 2012 at 14:16
  • 1
    An additional step needed is sysctl -w net.ipv4.conf.eth0.route_localnet=1. You can check the current value with sysctl net.ipv4.conf.eth0.route_localnet
    – chefarov
    Jan 21, 2019 at 20:45
1

Here's a link to a more recent answer: https://unix.stackexchange.com/questions/111433/iptables-redirect-outside-requests-to-127-0-0-1/112232

This one really helped me out.

Improve this answer
1
  • Rather than linking to a page, which might go away in the future, please summarize your answer here and also provide the link as reference material.
    – Kevin Panko
    May 16, 2014 at 5:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .