Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a postgresql instance running on SLES.

I want to set it up to listen on localhost, and enable iptables to perform port forwarding.

My current configuration

postgresql.conf:

listen_addresses = 'localhost'
port = 5432

pg_hba.conf:

local   all         all                               md5
host    all         all         127.0.0.1/32          md5
host    all         all         0.0.0.0/0          md5

iptables (rule added via 'iptables -t nat -I PREROUTING -p tcp --dport 5432 -j REDIRECT'):

Chain PREROUTING (policy ACCEPT 441 packets, 54049 bytes)
 pkts bytes target     prot opt in     out     source               destination
    6   420 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:5432

Configured like this, I am not able to open a psql connection to the DB.

Without the iptables rule, I get a "Connection refused" error.

With the iptables rule I get a "Connection timed out" error.

share|improve this question
1  
Why do you want to use port forwarding? Can't you just have postgres listen on the ethernet interface? –  Kyle Smith Jun 21 '11 at 10:43

1 Answer 1

You may need to check the filter table. For example, what is the default policy for INPUT? Do you have an explicit rule to allow port 5432 if not allowed by CHAIN policy.

Also, it may not be enough to write the rule as shown in your question. Read this from the man iptables:

REDIRECT
    This target is only valid in the nat table, in the PREROUTING and OUTPUT
    chains, and user-defined chains which are only called from those chains. 
    It redirects the packet to the machine itself by changing the destination IP
    to the primary address of the incoming interface (locally-generated packets are mapped to  the  127.0.0.1 address).

So, it will redirect the request to an IP address not necessarily localhost or 127.0.0.1. You may need to add the 127.0.0.1 IP address explicitly in the NAT rule. You can try:

iptables -t nat -I PREROUTING -p tcp --dport 5432 -j DNAT --to-destination 127.0.0.1
share|improve this answer
    
I added the DNAT rule, but this has not changed the results. –  David Resnick Jun 19 '11 at 12:33
    
Can you show us your iptables rules in the NAT and filter tables? You can use the commands: iptables -L -n and iptables -L -n -t nat. –  Khaled Jun 20 '11 at 7:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.