Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables:

iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \
         --dport 443 -j REDIRECT --to-ports 8080

This works for all external clients. But if I'm trying to access the port 443 from the same maschine I'll get a connection refused error.

wget https://localhost

How can I extend the iptables rule to redirect local traffic too?

share|improve this question
This topic provides a more general answer: – Jeroen Apr 18 '12 at 0:20
Can someone with rep add a backslash to the command before the line break? – Ciro Santilli 巴拿馬文件 六四事件 法轮功 Dec 18 '14 at 12:32

PREROUTING isn't used by the loopback interface, you need to also add an OUTPUT rule:

iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080
iptables -t nat -I OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8080
share|improve this answer
No need for the first rule. The locally generated packets does not pass via the PREROUTING chain. – Khaled Dec 11 '10 at 12:43
I added the initial rule for compeletion's sake, as he wants external traffic to redirect as well. The rule doesn't need source/destination if they only say to accept all IPs – Andy Dec 11 '10 at 12:54
oh appologies I didn't see your answer when I replied. – Andy Dec 11 '10 at 12:57
Hi Andy, I'm still getting Connecting to|<ip>|:443... failed: Connection refused. – Chris Dec 11 '10 at 13:24
Hi Chris, is that the Connecting to localhost||443 or is that the domain? If the latter and you're running it from your server, you might have a internal routing problem. You could double check by trying wget (although I assume the reason you're port forwarding is because its blocked externally?). My own VPC has that problem, however you could possibly put a workaround by defining the domain as in your /etc/hosts file. – Andy Dec 12 '10 at 12:49

How about this?

iptables -t nat -A OUTPUT -d -p tcp --dport 443 -j REDIRECT --to-port 8080

share|improve this answer

You said you are getting connection refused error. This means that there is no local process listening on the port you are trying to connect to! To check the listening processes, use the command:

$ sudo netstat -lnp | grep 8080

After applying the rule, you should have a process listening on the port 8080 to get connected.

It seems that you should have the following rule instead:

$ iptables -t nat -I OUTPUT --source 0/0 --destination 0/0 -p tcp
                                       --dport 443 -j REDIRECT --to-ports 8080

Remember that you are sending from the localhost. So, you need to redirect the output packet.

share|improve this answer
Thanks for yor answer. The process is listening on port 8080. Therefor I want to redirect all traffic to that port. – Chris Dec 11 '10 at 11:53
Are you sure the process is listening on the loop interface as well? It may only be listening on your physical interface. Typically, your webserver will need to listen to rather than, say, – MrMajestyk Feb 2 '15 at 11:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.