Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set up following ip tables rule:

sudo iptables -t nat -I PREROUTING --dst 192.168.0.116  -p tcp --dport 80 -j REDIRECT --to-ports 8000


sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             static.snake2.test tcp dpt:www redir   ports 8000

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination

That will forward any traffic on port 80 on the given ip to port 8000 on the same ip. Works perfectly through a browser.

What does not work is, if I try to run some test directly from console:

lynx -head -dump http://192.168.0.116

or what I intended to do

ab -n 1000 -c20 192.168.0.116

In that case the forwarding rule simply does not work. The header given back is still from port 80 (apache) and not like expected from nginx (8000).

share|improve this question
    
Can you please edit your question to contain the contents of iptables -L? –  MDMarra Feb 20 '12 at 16:05
    
I have just added the output –  merlin Feb 20 '12 at 16:51

1 Answer 1

up vote 3 down vote accepted

I'm pretty sure that the reason you are seeing this is that the PREROUTING chain is not applicable to the packets that go via the loopback interface. When you say it works from a browser, I assume you mean from another machine, in which case your rule will apply. You'll need to add a rule to the OUTPUT chain too to get it to work on the localhost traffic. Something like this:

iptables -t nat -I OUTPUT --source 0/0 --destination 0/0 -p tcp --dport 80 -j REDIRECT --to-ports 8000
share|improve this answer
    
you are right! neptun:~$ lynx -head -dump 192.168.0.116 HTTP/1.1 200 OK Server: nginx @snake2:~$ lynx -head -dump 192.168.0.116 HTTP/1.1 200 OK Date: Mon, 20 Feb 2012 17:12:04 GMT Server: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/1.0.0e Do you know how I can add a rule to the OUTPUT chain to make that work? –  merlin Feb 20 '12 at 17:14
    
I haven't tested this, but I would expect something like the rule I added above would do it. –  Adam C Feb 20 '12 at 17:33
    
Perfect! Works excellent. Thank you for your help. –  merlin Feb 21 '12 at 10:11
    
excellent :) if you can accept the answer I'd appreciate it - need the help on the rep front ;) –  Adam C Feb 21 '12 at 10:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.