Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands:

iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -I OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080

I achieved the goal in regard to Tomcat, but it screwed up some other things; for example, when I attempt to run `yum update yum', I get the following errors: [Errno 4] IOError: <urlopen error (111, 'Connection refused')>
Trying other mirror. [Errno 4] IOError: <urlopen error (111, 'Connection refused')>

WGET fails in similar fashion.

I know that the iptables rules are to blame because removing them fixed the problem with YUM and WGET. So, why are those rules screwing up YUM and WGET? I'm guessing it's the OUTPUT rule, right? What does it actually do, and why is it necessary? Is that nasty side-effect avoidable?

share|improve this question
up vote 3 down vote accepted

If you are running Tomcat on the server it is the inbound traffic that needs to be redirected to port 8080 and not outbound.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-ports 8080

The second rule redirects incoming requests on port 80 generated from the local node where Tomcat is running as mentioned in the link. It is needed only if you want access tomcat on port 80 from within the server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.