Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

what I want to do is to redirect web traffic in this way:

  1. Every request to port 80 that HTTP GETs a given address should be redirected to a particular port (4444).

  2. Every other request goes to port 80.

Since I can't do it by using web proxy modules and / or forwarding for various reasons, I'm looking for a way to do it with iptables. Inspired by this article, i used this rule for my iptables:

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 \
  -m string --algo bm --string 'GET /mjpegcgi.cgi' \
  -j REDIRECT --to-port 4444

Then I opened two netcat processes listening on 4444 and 80. However, when I try to test the rule with:

wget -qO- http://192.168.1.88/mjpegcgi.cgi

What I have is always response from port 80 only. What am I doing wrong?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You can't meaningfully redirect a connection like this using the string match. By the time the GET request comes over the wire the connection has already been established. Remember, a TCP connection starts with a three-way handshake; the exchange that establishes the connection does not include any HTTP protocol data.

Also, REDIRECT rules will not affect traffic that originates on your local host. If you are testing REDIRECT rules, also make sure you are testing from another system.

You really need to implement a protocol-level proxy to do this sort of thing (for example, Apache's mod_rewrite with a proxy target would work).

share|improve this answer
    
When I test this rule from an external server, though, the connection is perfectly successful (netcat returns with its control string from port 80). Shouldn't it be disrupted? Shouldn't the packet with the http GET eventually forwarded to 4444 and NOT to 80, preventing netcat on port 80 to receive the GET and answer me? –  janesconference Feb 24 '12 at 16:23
    
mod_rewrite does not work with external processes. I could use the server on 80 as a proxy for the server on 4444, but this would mean an http connection between the two. I'm streaming a lot of data, and that would hinder performances in a serious way. –  janesconference Feb 24 '12 at 16:30
2  
(1) Once the connection is established, you can't make routing decisions about it. The REDIRECT rule you have is a no-op. (2) I'm not sure what you mean by "mod_rewrite does not work with external processes". I was suggesting using it as a proxy in lieu of a REDIRECT rule, which yes, does mean it is proxying HTTP requests from port 80 to your target process. I'm not sure how else you will achieve a URL-level redirect to another port short of some sort of HTTP proxy. –  larsks Feb 24 '12 at 16:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.