Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A while back, I wanted to redirect all port 80 traffic on an Ubuntu server to port 3000 for a Rails app. Instead of just using iptables, I googled around and found some other way to do it (I can't imagine why I didn't find iptables first), but now I can't remember how I did it! Is there some way to track what's going on so I can turn it off? There are no rules in iptables and traffic never gets to apache.

Thanks!

UPDATE:

No, you normally just need to load the new ruleset. See: askubuntu.com/q/161551/266 . But don't despair. Iptables can be confusing. – Stefan Lasiewski

share|improve this question
1  
I learned today that you need to reboot the server for deleted iptables rules to cease effect. -- No, you normally just need to load the new ruleset. See: askubuntu.com/q/161551/266 . But don't despair. Iptables can be confusing. –  Stefan Lasiewski Jan 28 '13 at 22:00

2 Answers 2

Type the following command:

# netstat -tulpn | grep :80

It should output something like this example:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1138/mysqld
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      850/portmap
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1607/apache2
tcp        0      0 0.0.0.0:55091           0.0.0.0:*               LISTEN      910/rpc.statd
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1467/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      992/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1565/cupsd
tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN      3813/transmission
tcp6       0      0 :::22                   :::*                    LISTEN      992/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      1565/cupsd
tcp6       0      0 :::7000                 :::*                    LISTEN      3813/transmission
udp        0      0 0.0.0.0:111             0.0.0.0:*                           850/portmap
udp        0      0 0.0.0.0:662             0.0.0.0:*                           910/rpc.statd
udp        0      0 192.168.122.1:53        0.0.0.0:*                           1467/dnsmasq
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1467/dnsmasq
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3697/dhclient
udp        0      0 0.0.0.0:7000            0.0.0.0:*                           3813/transmission
udp        0      0 0.0.0.0:54746           0.0.0.0:*                           910/rpc.statd   

As you can see above the first entry, TCP port 3306, was opened by mysqld process having PID # 1138. Just look at your entry for port 80 and see what service and process ID is running on it. You can than verify this using /proc, enter the command:

# ls -l /proc/1138/exe

You will replace 1138 with whatever PID is on port 80 for you.

It should output something like this:

lrwxrwxrwx 1 root root 0 2010-10-29 10:20 /proc/1138/exe -> /usr/sbin/mysqld

This will give you the location of that program that is running behind it.

If you have port forwarding up using SSH then you need to reconfigure your sshd_config file located here with a text editor...vim or gedit will do the trick:

sudo vi /etc/ssh/sshd_config

sudo gedit /etc/ssh/sshd_config

In this file you should see an entry like this just simple comment it out or change it to no. To comment it out put a # symbol in front of it then save and close:

# Port forwarding
AllowTcpForwarding yes
share|improve this answer
    
Regarding your comment below. Do you have an SSH service running doing port forwarding? If that is the case then you need to configure your ssh_config files and remove the port forwarding. –  Kentgrav Jan 28 '13 at 21:35

To find out what process is listening on port 80:

sudo netstat -tnlp | grep -w 80

It should hopefully be obvious from the output what it is.

share|improve this answer
    
No luck. If I have apache running, then it shows up, and if I stop apache then nothing is listening on port 80. Traffic is still passing through port 80 and getting redirected to port 3000 before it hits apache. –  robamaton Jan 28 '13 at 21:27
1  
Are you sure you didn't set up that iptables rule after all? –  Michael Hampton Jan 28 '13 at 21:28
1  
You're right. I hadn't rebooted and didn't realize that the iptables rules weren't immediately removed. –  robamaton Jan 28 '13 at 21:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.