4

So, I have my Glassfish server is listening on port 8080.
However, I want to have my requests at port 80 while hiding 8080,
so that people think my server really runs at 80.

How can I do it with iptables? I have tried the following rule:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

but it's not what I want, because I have to open both 80 and 8080 for it to work.

Any ideas?


Update: I've changed my rules' file to look like:

iptables -F

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

iptables -A INPUT -j DROP

#REDIRECTION RULES
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT  \
         --to-destination 127.0.0.1:8080

But still doesn't work. I have /proc/sys/net/ipv4/ip_forward set to 1.
Nor http://myserver:8080 neither http://myserver:80 work. The packets are dropped.

1
  • Please help! What I'm doing wrong? Aug 4, 2011 at 20:03

5 Answers 5

3

Use DNAT.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination your.ip.address:8080

Something like that should work. :)

EDIT after your own edit: I think this line is too early in your rule set:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Thanks to that your server does not accept any NEW connections, right? Try to move it right before your iptables -A INPUT -j DROP line.

4
  • Mmmm, doesn't work. I will edit my question and add my rules file. Aug 4, 2011 at 9:15
  • Also tell us how it does not work. Aug 4, 2011 at 9:19
  • Edited my reply. Aug 4, 2011 at 9:26
  • So, what will be the correct position of the rule? I thought it was in its correct position. Aug 4, 2011 at 9:31
3

I had exactly the same question and found the answer with help of this community. Here is the link:

Port redirection with iptables to localhost / blocking the destination port

I solved the problem by marking the packets incoming on 8080 and filtering them afterwards:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 8080 -j MARK --set-mark 1
iptables -A INPUT -m mark --mark 1 -j DROP

The last rule to drop the marked packets could be the very first rule in your INPUT chain.

DNAT did not work for me with localhost. I think this is because localhost is treated specially in the kernel.

0

Have you tried changing:

iptables -P FORWARD DROP

to

iptables -P FORWARD ACCEPT

?

0
echo "redirect port 8080 to 80 and drop packets to 8080"
iptables -t mangle -A PREROUTING -p tcp --dport 8080 -j MARK --set-mark 8080
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -A INPUT -m mark --mark 8080 -j DROP
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
0

While the question is quite old, I just want to chime in with my own answer as I had a similar issue and this was one of the first google results, the trick here is to only open the port 80, but you add a rule to accept any packets that have already been DNAT'ed on the input interface, please note as well to not use 127.0.0.1 as that is blocked by default in the kernel (see net.ipv4.conf.all.route_localnet)

iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT  
iptables -A INPUT -p tcp -m conntrack --cstate DNAT -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination myserver:8080

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .