Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work with Debian (Linux) and try to change the destination of incoming packets from port 80. Here's the setup: I have my firewall that has two addresses and a web server that has two addresses.

Example:

FireWall

Internal adress: 10.3.3.13
External adresss: 206.167.200.213

Web Server

Internal adress: 10.3.3.6
External adress: 206.167.200.206

I need to redirect incoming connection from port 80 on my firewall to port 80 on the web server.

Here's the command line I'm using in Debian:

iptables -t nat -A PREROUTING -i eth0 -p tcp -d 10.3.3.6 --dport 80 -j DNAT --to 10.3.3.6
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i eth0 -j ACCEPT

Why doesn't this command work? When I enter the external address of my firewall, the redirect doesn't work and I end up on the default web page of my firewall.

share|improve this question
    
You got the IP for the -d parameter wrong. –  ninjalj Nov 1 '11 at 16:57
add comment

migrated from stackoverflow.com Dec 29 '11 at 12:07

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 1 down vote accepted

I've found the solution, here's the way to do it:

# Redirect incoming connexion to port 80 on the web server
iptables -t nat -A PREROUTING -p tcp -d $FIREWALL_INT_IP --dport 80 -j DNAT --to-destination $SERVER_INT_IP:80
iptables -t nat -A POSTROUTING -p tcp -d $SERVER_INT_IP -j SNAT --to $FIREWALL_INT_IP
iptables -A FORWARD -p tcp -i eth0 -d $SERVER_INT_IP --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -o eth0 -s $SERVER_INT_IP --sport 80 -j ACCEPT
share|improve this answer
add comment

Try this one

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10.3.3.13:80 -j REDIRECT --to-port 10.3.3.6:80
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 206.167.200.213:80 -j REDIRECT --to-port 206.167.200.206:80
share|improve this answer
    
I get this error: iptables v1.4.8: invalid port/service 10.3.3.13' specified Try iptables -h' or 'iptables --help' for more information. iptables v1.4.8: invalid port/service 206.167.200.213' specified Try iptables -h' or 'iptables --help' for more information. –  Simon Nov 1 '11 at 22:04
    
Also, I forgot to mention the firewall and the web server are on the same interface (they are VMs). –  Simon Nov 1 '11 at 22:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.