-1

A while back, I wanted to redirect all port 80 traffic on an Ubuntu server to port 3000 for a Rails app. Instead of just using iptables, I googled around and found some other way to do it (I can't imagine why I didn't find iptables first), but now I can't remember how I did it! Is there some way to track what's going on so I can turn it off? There are no rules in iptables and traffic never gets to apache.

Thanks!

UPDATE:

No, you normally just need to load the new ruleset. See: askubuntu.com/q/161551/266 . But don't despair. Iptables can be confusing. – Stefan Lasiewski

1
  • 1
    I learned today that you need to reboot the server for deleted iptables rules to cease effect. -- No, you normally just need to load the new ruleset. See: askubuntu.com/q/161551/266 . But don't despair. Iptables can be confusing. Jan 28, 2013 at 22:00

2 Answers 2

2

Type the following command:

# netstat -tulpn | grep :80

It should output something like this example:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1138/mysqld
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      850/portmap
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1607/apache2
tcp        0      0 0.0.0.0:55091           0.0.0.0:*               LISTEN      910/rpc.statd
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1467/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      992/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1565/cupsd
tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN      3813/transmission
tcp6       0      0 :::22                   :::*                    LISTEN      992/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      1565/cupsd
tcp6       0      0 :::7000                 :::*                    LISTEN      3813/transmission
udp        0      0 0.0.0.0:111             0.0.0.0:*                           850/portmap
udp        0      0 0.0.0.0:662             0.0.0.0:*                           910/rpc.statd
udp        0      0 192.168.122.1:53        0.0.0.0:*                           1467/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1467/dnsmasq
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3697/dhclient
udp        0      0 0.0.0.0:7000            0.0.0.0:*                           3813/transmission
udp        0      0 0.0.0.0:54746           0.0.0.0:*                           910/rpc.statd   

As you can see above the first entry, TCP port 3306, was opened by mysqld process having PID # 1138. Just look at your entry for port 80 and see what service and process ID is running on it. You can than verify this using /proc, enter the command:

# ls -l /proc/1138/exe

You will replace 1138 with whatever PID is on port 80 for you.

It should output something like this:

lrwxrwxrwx 1 root root 0 2010-10-29 10:20 /proc/1138/exe -> /usr/sbin/mysqld

This will give you the location of that program that is running behind it.

If you have port forwarding up using SSH then you need to reconfigure your sshd_config file located here with a text editor...vim or gedit will do the trick:

sudo vi /etc/ssh/sshd_config

sudo gedit /etc/ssh/sshd_config

In this file you should see an entry like this just simple comment it out or change it to no. To comment it out put a # symbol in front of it then save and close:

# Port forwarding
AllowTcpForwarding yes
1
  • Regarding your comment below. Do you have an SSH service running doing port forwarding? If that is the case then you need to configure your ssh_config files and remove the port forwarding.
    – Kentgrav
    Jan 28, 2013 at 21:35
1

To find out what process is listening on port 80:

sudo netstat -tnlp | grep -w 80

It should hopefully be obvious from the output what it is.

3
  • No luck. If I have apache running, then it shows up, and if I stop apache then nothing is listening on port 80. Traffic is still passing through port 80 and getting redirected to port 3000 before it hits apache.
    – robamaton
    Jan 28, 2013 at 21:27
  • 1
    Are you sure you didn't set up that iptables rule after all? Jan 28, 2013 at 21:28
  • 1
    You're right. I hadn't rebooted and didn't realize that the iptables rules weren't immediately removed.
    – robamaton
    Jan 28, 2013 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .