Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We want to forward all http traffic to another IP address on an Amazon EC2 stock Linux machine (CentOS based). I know how to do this with proxy rules and apache, but I was assuming iptables would be a much faster solution (perhaps not!)

Commands

sudo iptables -P INPUT ACCEPT
sudo iptables -F
sudo iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 80 -j DNAT --to 208.68.208.81:80
sudo iptables -A FORWARD -p tcp -d 208.68.208.81 --dport 80 -j ACCEPT

iptables -t nat -L -v -n

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 to:208.68.208.81:80

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 11 packets, 820 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 11 packets, 820 bytes)
 pkts bytes target     prot opt in     out     source               destination

iptables -L -v -n

Chain INPUT (policy ACCEPT 202 packets, 15705 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            208.68.208.81       tcp dpt:80

Chain OUTPUT (policy ACCEPT 145 packets, 13747 bytes)
 pkts bytes target     prot opt in     out     source               destination

http://208.68.208.81 into a web browser works, but when I try the ip address of the EC2 machine with this config I get a timeout. I do see some packets show up with watch -d iptables -t nat -L -v -n

Help!

Update: added -i eth0 to PREROUTING rule

share|improve this question
1  
Can you reach 208.68.208.81 from the EC2 machine using something like curl/wget/lynx? –  Zoredache May 2 '12 at 20:02
    
Thanks for the tip, I did not think to test this, however wget http://208.68.208.81 works as expected –  Juzzam May 2 '12 at 21:21

2 Answers 2

You have created a loop. Make sure you add the in interface to the PREROUTING rule (eg. -i eth1 or whatever).

You may also need a rule like this:

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 

  45M 3723M MASQUERADE  all  --  *     WAN_IF  0.0.0.0/0            0.0.0.0/0  

Otherwise the packets will go directly from the machine they were forwarded to back to the client, I think, which will not be expecting them from that host.

share|improve this answer
    
I added -i eth0 and updated all the listings in my post, it didn't seem to help however –  Juzzam May 2 '12 at 21:25
    
is the machine configured to forward packets in /proc/sys/net/ipv4/conf/all/forwarding? You can also replace all with an interface name, but it has to contain 1 for the unit to actually forward anything. Also, can you reach 208.68.208.81 directly from the internet? If not, you may also need an SNAT rule to actually do NAT. For what you have now, the request goes through the firewall+NAT, but the reply goes back direct (well, addressed to the client, anyway). –  Falcon Momot May 2 '12 at 23:08
    
Added one more thing to the answer based on my setup which does a similar thing (redirects botnet attacks to a honeypot). –  Falcon Momot May 2 '12 at 23:16

You may use rinetd to simply forward your ip traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.