Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a simple iptables setup that isn't quite right, and I'd love to know why it works this way and what I can do to get this working. Here are my rules:

# redirect 80 to site
sudo iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to 8080

sudo iptables -A INPUT -s 127.0.0.1 -j ACCEPT # local is good
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # stuff from me is good 
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT # ssh is good
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # and so is web
sudo iptables -A INPUT -j DROP # culprit?

So the port forwarding from 80 to 8080 is cool, until I add the last DROP rule. When I do I get timeouts on the request. Is there something I have to chain to get the drop and the prerouting to work together, or is the mistake something else? Thanks for your help.

share|improve this question

1 Answer 1

up vote 8 down vote accepted

Most helpful tool concerning iptables EVER:

http://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg

See that -t nat -A PREROUTING gets applied to the packet before it reaches the INPUT chain. So, ACCEPT --dport 8080 instead of --dport 80.

share|improve this answer
    
Awesome, thank you. –  blu Jun 25 '12 at 17:00
    
@MDMarra: Thanks for the edit, good hint, I'm not yet familiar with this wiki dialect. –  Michuelnik Jun 25 '12 at 18:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.