iptables NAT table not matching anything [duplicate]

Question

I am attempting to take a TCP service running on port 1234, and make it appear as if it's running on port 81. I thought the following might do it:

iptables -A PREROUTING -t nat -p tcp --dport 81 -j REDIRECT --to-port 1234

However, if I fire up nc -l 1234 in one terminal, then nc 127.0.0.1 81 in another, I don't get a connection. The second nc just exits immediately. tcpdump tells me:

$ sudo tcpdump -i lo -v
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
07:54:21.628583 IP (tos 0x0, ttl 64, id 60458, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.45729 > localhost.81: Flags [S], cksum 0xfe30 (incorrect -> 0x06a3), seq 4232210875, win 43690, options [mss 65495,sackOK,TS val 755089 ecr 0,nop,wscale 6], length 0
07:54:21.628595 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    localhost.81 > localhost.45729: Flags [R.], cksum 0x98dc (correct), seq 0, ack 4232210876, win 0, length 0

Looks as if the connection is attempted, then immediately reset. I see there's an incorrect checksum -- is that a problem, and if so, how do I fix it?

The other nc is listening on port 1234, as verified by netstat and attempting to connect to port 1234 directly, successfully.

Oddly, nothing seems to be matching PREROUTING the nat table at all:

$ sudo iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81 redir ports 1234

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 2 packets, 120 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 2 packets, 120 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Note the 0 counters, despite my multiple attempts to make the connection with nc above. Now, it's my understanding that all traffic should be going through the PREROUTING chain, so I should see something. What gives?

Answer 1

NAT redirection doesn't work on traffic both from and to localhost. Try from another system on the LAN.

Edit: Try looking at this question, which deals with getting unprivileged daemons to listen on privileged ports. The first answer is of no help, but the next one down should be.

As for whether telling you that it doesn't work is not helpful, you are completely free to think that. Note, however, that I've saved you wasting time debugging your NAT rules, by letting you know that you don't have an implementation problem; instead, the issue is that you can't do what you want in the way you want to do it. Probably only Rusty Russell can tell you why it doesn't work.