Port forwarding without IP address translation

Question

I have a number of services that I'd like to run on unprivileged ports and use iptables to map standard privileged ports to the unprivileged ones (e.g. 80->8080).

I've been reading the iptables docs from netfilter.org and various tutorials and forums and every example I see translates the IP address in addition to forwarding the port (e.g. 10.0.1.1:80 -> 10.0.1.2:8080).

So my question is, I think, fairly simple. Is it possible to do port forwarding without IP address translation? So the iptables command might look something like this:

iptables -A PREROUTING -t nat -p tcp -d 192.168.1.1 --dport 80 -j DNAT --to 192.168.1.1:8080

If it is possible, is the above command correct (assuming an appropriate FORWARD rule accepts the connection)?

Thanks.

Answer 1

Yes, your command is correct. The command presented by Arenstar is only valid for redirecting the traffic to localhost (127.0.0.1).

For more info, see man iptables. Look at REDIRECT paragraph.

Answer 2

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 8080

Should do the trick :)