Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8181 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8181 -m state --state ESTABLISHED,RELATED -m limit --limit 50/second --limit-burst 50 -j ACCEPT

iptables -A PREROUTING -t nat -p tcp --dport 80 -j DNAT --to-destination :8080
iptables -A PREROUTING -t nat -p tcp --dport 443 -j DNAT --to-destination :8181
iptables -A FORWARD -p tcp -m multiport --dports 8080,8181 -j ACCEPT

I am trying to redirect traffic on 80 to 8080 and 443 to 8181. This was succesful by using preceding lines. Now I am trying to restrict access to 8080 and 8181 directly, though I am not sure how.

I know there are some questions concerning this issue, though I haven't found any solution. Despite the accepted answer in this question, I know this should be possible by just using iptables.

Any help would be appreciated.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

The packets go through netfilter chains like this: PREROUTING->Routing Decision->INPUT if their destination address is your machine. DNAT which is applied in PREROUTING chain changes destination of the packets, it does not make them go both ways. So they get to the INPUT chain with dports 8080 or 8181, nothing goes to 80 and 443.

UPD: I finally see what you are trying to do. Try this rule
iptables -A INPUT -p tcp -m multiport --dports 8080,8181 -m conntrack ! --ctstate DNAT -j DROP

share|improve this answer
    
You're right. With 8080 and 8181 open I will still receive the traffic from HTTP and HTTPS. Though does this mean I can possibly block this incoming on 8080 and 8181 during PREROUTING? –  Aquillo Mar 27 '13 at 21:32
    
Seems like iptables -A PREROUTING -t nat -p tcp --dport 8080 -j DNAT --to-destination :999 or some other closed port would do the trick, though I don't feel like this is a clean solution? –  Aquillo Mar 27 '13 at 21:39
1  
@Aquillo I've updated the answer with a rule you might try. –  pupkinsen Mar 28 '13 at 4:06
    
Thanks for your help and time investment, I really appreciate this. I have used your rule though I used -I (so it preceeds the rules defined by me). This way 80 is accessible though 8080 is not. –  Aquillo Mar 28 '13 at 6:28

Just limit it based on the interface.

iptables -A INPUT -p tcp -i eth0 --dport 8080 -j DROP

share|improve this answer
    
That would be the same as not using 8080 and 8181 in the first two rules (policy is DROP)? That was my first try, though my service was not available on 80 without 8080 open. –  Aquillo Mar 27 '13 at 18:58
    
I dont think so no, because your first two lines don't match on the interface, so removing 8080 and 8081 from it will drop the traffic from the localhost interface also (if you have a default drop policy). –  Sirex Mar 27 '13 at 20:53

Did you try this rules? i think the burst limit will not block traffick because the last line will accept it.

If you default policy is drop you can't restrict the acces even more. You only can permit some traffic -for example with your rules-.

share|improve this answer
    
I know what you mean, but, isn't there perhaps a way to not having to open 8080 and 8181 at all? –  Aquillo Mar 27 '13 at 20:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.