Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running cPanel/WHM with ConfigServer Firewall (csf).

I want to forward port 8080 on my webserver to an internal server with an IP of lets say 10.1.1.1 thats running a webserver on port 80. How can I do this?

My WAN ip is running on eth0 The internal server is connected using the eth1 interface.

What would be the appropriate IPtables cmd to do this?

share|improve this question

migrated from stackoverflow.com Jul 12 '11 at 4:06

This question came from our site for professional and enthusiast programmers.

    
Dup of: serverfault.com/questions/289205/… –  Ward Jul 12 '11 at 5:07

2 Answers 2

Something like this should work

sudo /sbin/iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.1.1.1:80

If you haven't already done so you may need to enable IP forwarding too

/sbin/sysctl -w net.ipv4.ip_forward=1

and to make it permanent edit /etc/sysctl.conf and set

net.ipv4.ip_forward = 1

EDIT:

As the policy on your FORWARD chain is DROP you will need to allow packets through. I don't think your current FORWARD rule is doing anything helpful so delete it.

Enable packets sent to FORWARD from eth0:8080 to be sent to 10.1.1.1

/sbin/iptables -I FORWARD  -p tcp -m tcp  -d 10.1.1.1 --destination-port 80 -j ACCEPT

Allow packets to go the other way too

/sbin/iptables -I FORWARD -i eth1 -p tcp -m tcp -j ACCEPT

You mat want to restrict the latter further.

share|improve this answer
    
Will that actually working considering the 10.1.1.1 ip is on eth1? –  William Balkcom Jul 11 '11 at 22:37
    
Didn't seem to work. –  William Balkcom Jul 12 '11 at 0:00
    
@WilliamBalkcom: yes, you are routing packets from eth0:8080 -> 10.1.1.1:80 or at leasts that's what you requests. This works on a test system I have. Check that you have something listening on 10.1.1.1:80. Is 10.1.1.1 running a firewall and is it allowing connections on port 80 ? Check that your FORWARD chain is allowing packets. –  Iain Jul 12 '11 at 6:55
    
I have a webserver listening on 10.1.1.1:80, it is allowing all connections. The connection to 10.1.1.1 is established through eth1 and eth1 is configured like this: gyazo.com/42a58b08b6d2dcbd1bee2b5148a478e6.png And actually the IP is 10.1.3.98, just using 10.1.1.1 as an example. –  William Balkcom Jul 12 '11 at 7:11
    
@WilliamBalkcom: please post the (suitably redacted) output of iptables -l -v -n and iptables -t nat -L -v -n –  Iain Jul 12 '11 at 8:29

Something like:

iptables -A PREROUTING -t nat -i eth1 -p tcp \ 
  --dport 8888 -j DNAT --to 10.1.1.1:80

Sends forwards the requests on port 8888.

iptables -A INPUT -p tcp -m state --state NEW --dport 8888 -i eth1 -j ACCEPT

Allows incoming connections ton port 8888.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.