Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day, I had a Tomcat running on port 80 on a CentOS server with IP When I tried to open "" on my notebook I could see Tomcat welcome page. Then I changed Tomcat port to 8080 and redirected HTTP traffic on port 80 to port 8080 using iptables:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080

Now when I try to open "" on my notebook I'm getting timeout. But when I try to open "" or "" directly on the server both URLs works fine. What am I missing please?

There is a Cisco firewall between the notebook and the server which allows communication on port 80 only. This is my iptables configuration file:

# Generated by iptables-save v1.4.7 on Wed Oct 17 14:51:20 2012
:OUTPUT ACCEPT [1027:228609]
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state INVALID -j DROP 
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT 
# Completed on Wed Oct 17 14:51:20 2012
# Generated by iptables-save v1.4.7 on Wed Oct 17 14:51:20 2012
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
-A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
# Completed on Wed Oct 17 14:51:20 2012

Many thanks in advance. Vojtech

share|improve this question

migrated from Oct 17 '12 at 18:38

This question came from our site for professional and enthusiast programmers.

The redirection of iptables is configured on the server right ? (just to clarify). – Niloct Oct 17 '12 at 14:53
Yes, on the CentOS server. – Vojtech Oct 17 '12 at 16:04
Can you telnet 80 from the notebook ? – Niloct Oct 17 '12 at 16:08
up vote 3 down vote accepted

The INPUT chain in the filter table shouldn't be DROP. (well, at least not exclusively without accepting ports!)

At least accept port tcp/8080 to make it work.

The packet first traverses the mangle-, then the prerouting, and then the filter table. Your mangle table is empty, you redirect in prerouting, but when the packet enters INPUT/filter, it's getting droped.

A simple iptables -t filter -A INPUT -p tcp --dport 8080 -j ACCEPT should be sufficient.

Edit: Accepting localhost in the INPUT-chain of filter should be there too, just not to complicate the things. Although you should consider implementing rules which are a littel more sophisticated, something like:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # don't you want ssh?
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

Something along those lines.

share|improve this answer
Many thanks, adding "iptables -A INPUT -p tcp --dport 8080 -j ACCEPT" before line "-A INPUT -j DROP" helped. – Vojtech Oct 18 '12 at 7:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.