Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Good day, I had a Tomcat running on port 80 on a CentOS server with IP 10.33.46.68. When I tried to open "http://10.33.46.68" on my notebook I could see Tomcat welcome page. Then I changed Tomcat port to 8080 and redirected HTTP traffic on port 80 to port 8080 using iptables:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080

Now when I try to open "http://10.33.46.68" on my notebook I'm getting timeout. But when I try to open "http://10.33.46.68" or "http://10.33.46.68:8080" directly on the server both URLs works fine. What am I missing please?

There is a Cisco firewall between the notebook and the server which allows communication on port 80 only. This is my iptables configuration file:

# Generated by iptables-save v1.4.7 on Wed Oct 17 14:51:20 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1027:228609]
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -m state --state INVALID -j DROP 
-A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT 
-A INPUT -j DROP 
COMMIT
# Completed on Wed Oct 17 14:51:20 2012
# Generated by iptables-save v1.4.7 on Wed Oct 17 14:51:20 2012
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [4:274]
:OUTPUT ACCEPT [2:154]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
-A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
COMMIT
# Completed on Wed Oct 17 14:51:20 2012

Many thanks in advance. Vojtech

share|improve this question

migrated from stackoverflow.com Oct 17 '12 at 18:38

This question came from our site for professional and enthusiast programmers.

    
The redirection of iptables is configured on the server right ? (just to clarify). –  Niloct Oct 17 '12 at 14:53
    
Yes, on the CentOS server. –  Vojtech Oct 17 '12 at 16:04
1  
Can you telnet 10.33.46.68 80 from the notebook ? –  Niloct Oct 17 '12 at 16:08
add comment

1 Answer

up vote 3 down vote accepted

The INPUT chain in the filter table shouldn't be DROP. (well, at least not exclusively without accepting ports!)

At least accept port tcp/8080 to make it work.

The packet first traverses the mangle-, then the prerouting, and then the filter table. Your mangle table is empty, you redirect in prerouting, but when the packet enters INPUT/filter, it's getting droped.

A simple iptables -t filter -A INPUT -p tcp --dport 8080 -j ACCEPT should be sufficient.

Edit: Accepting localhost in the INPUT-chain of filter should be there too, just not to complicate the things. Although you should consider implementing rules which are a littel more sophisticated, something like:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # don't you want ssh?
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable

Something along those lines.

share|improve this answer
    
Many thanks, adding "iptables -A INPUT -p tcp --dport 8080 -j ACCEPT" before line "-A INPUT -j DROP" helped. –  Vojtech Oct 18 '12 at 7:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.