Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a simple iptables setup that isn't quite right, and I'd love to know why it works this way and what I can do to get this working. Here are my rules:

# redirect 80 to site
sudo iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to 8080

sudo iptables -A INPUT -s -j ACCEPT # local is good
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # stuff from me is good 
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT # ssh is good
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # and so is web
sudo iptables -A INPUT -j DROP # culprit?

So the port forwarding from 80 to 8080 is cool, until I add the last DROP rule. When I do I get timeouts on the request. Is there something I have to chain to get the drop and the prerouting to work together, or is the mistake something else? Thanks for your help.

share|improve this question
up vote 8 down vote accepted

Most helpful tool concerning iptables EVER:

See that -t nat -A PREROUTING gets applied to the packet before it reaches the INPUT chain. So, ACCEPT --dport 8080 instead of --dport 80.

share|improve this answer
Awesome, thank you. – blu Jun 25 '12 at 17:00
@MDMarra: Thanks for the edit, good hint, I'm not yet familiar with this wiki dialect. – Michuelnik Jun 25 '12 at 18:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.