Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I configured port forwarding through iptables and ufw. But there is something I do not understand, I just cant get iptables to forward port 443 to 8443 without allowing port 8443 on UFW.

I want port 443 to forward to port 8443 but I also want port 8443 to be disallowed from outside my network.

In resume, I can only forward port 443 to 8443 if I fully allow both ports 443 and 8443 on UFW.

This is the only rule I have in before.rules:

-A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443

This is my iptables routing config (really simple):

pkts bytes target     prot opt in     out     source               destination
0     0 REDIRECT   tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 redir ports 8443

This is my UFW status that works:

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
443                        ALLOW       Anywhere
8443                       ALLOW       Anywhere       // THIS IS WHAT BOTHERS ME
22                         ALLOW       Anywhere (v6)
443                        ALLOW       Anywhere (v6)
8443                       ALLOW       Anywhere (v6)  // THIS IS WHAT BOTHERS ME

This is how i want my firewall protection but does not work:

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
443                        ALLOW       Anywhere
22                         ALLOW       Anywhere (v6)
443                        ALLOW       Anywhere (v6)

Any ideas? Thanks in advance.

share|improve this question
    
Your PREROUTING rule changes only the destination port. For this to work you must allow connections from anywhere to port 8443 because that is all the firewall can see. The only thing I can think of to fix this in the firewall, would be to use some sort of packet marking option to mark the packets as you change the destination port then drop any non-marked packets at 8443. Not sure how to do this though. –  DerfK Aug 19 '12 at 21:25

2 Answers 2

Instead of using PREROUTING to redirect the packets, you can use rinetd. This program listens on a given port, and when someone connects to it, rinetd connects to a given destination port and essentially proxies traffic between the two. With rinetd listening on port 443 and forwarding connections to port 8443, you can allow connections on 8443 from localhost and block all others.

share|improve this answer
    
Port forwarding is built in to xinetd, which should already be available on an Ubuntu system. No need to download anything else. –  Michael Hampton Aug 19 '12 at 21:30
    
Worked like a charm. I actually blended both DerfK's and Michael's solutions into my own. I used xinetd, but had to install it into Ubuntu 12. I will edit your answer with the full solution. –  Lisandro Aug 20 '12 at 14:50
    
One thing to note: doesn't seem that xinetd adds "X-Forwarded-For" headers, but it does alter the IP. This might be problematic if your destination service needs to know the originating IP. –  user67641 Mar 3 '13 at 19:42
up vote 1 down vote accepted

Here goes the solution that to me should be the default way of forwarding ports, I really do not understand why most people use iptables.

(1): if you already configured port forwarding with iptables/ufw or any other tool remove the rules. in my case from /etc/ufw/before.rules

(2): disallow the port that you had to expose in order to forward. In my case 8443.

(3): I had to install xinetd in Ubuntu 12.04

 #apt-get install xinetd

(4): create the new service that will forward the port:

vi /etc/xinetd.d/tomcat-https With this content:

service tomcat-https
{
disable                 = no
flags                   = REUSE
wait                    = no
user                    = root
socket_type             = stream
protocol                = tcp
port                    = 443
redirect                = localhost 8443
log_on_success  -= PID HOST DURATION EXIT

#per_source = UNLIMITED
#instances = UNLIMITED

}

(5): Add the service to /etc/services

vi /etc/services

This line:

https           443/tcp         # http protocol over TLS/SSL

Should look like this:

https           443/tcp         tomcat-https    # http protocol over TLS/SSL

Finally I had to do a full reboot. You might try restarting ufw, networking and xinetd.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.