Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First experience w/iptables, using it to reroute traffic from port 80 to 8080 so I can run an application server with just user permissions. I solved the problem, but I don't know why it works, and I was hoping to be set straight.

My iptables -t nat -L is as follows:

Chain PREROUTING (policy ACCEPT)  
target    prot  opt source     destination
REDIRECT  tcp   --  anywhere   anywhere            tcp dpt:http redir ports 8080

Chain OUTPUT (policy ACCEPT)  
targetprot  opt source     destination
REDIRECT  tcp   --  anywhere   localhost           tcp dpt:http redir ports 8080
REDIRECT  tcp   --  anywhere   _hostname_          tcp dpt:http redir ports 8080

Two things about the OUTPUT rules I wasn't able to grok:

1)Shouldn't I be redirecting to port 80 instead of 8080? Redirecting to 8080 seems wrong to me, because I was under the impression that clients send requests to 80. Wouldn't they expect responses from such as well?

2) Why the references to localhost and hostname here? If it's OUTPUT, isn't the destination literally anywhere BUT here?

Any answers are appreciated---I'm a total noob and this isn't particularly urgent, but I do want to understand this.

share|improve this question

There's two things to know:

First, DNAT (REDIRECT) should automatically "fix" the IP/port information on the return trip using conntrack. Therefore, there's no explicit rule in iptables to map from port 8080 back to 80, it's handled automatically. You can watch conntrack in action under /proc/net/ip_conntrack or by using the conntrack-tools package.

Second, the OUTPUT chain is for packets originating on that computer, while PREROUTING is for packets arriving on the computer from the outside. There's an explanation here, but the flow diagram given is based around firewall operation so it doesn't show the path a packet goes through when sent to itself. Essentially, those two OUTPUT rules are to make sure that if you connect from the server to itself (destination is either or the public IP), the connection is redirected from 80 to 8080.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.