0

We have a proxy filtering connections but some sites use RTMP, which runs on port 1935. This cannot go through the proxy as proxies are port 80 only.

As far as I know if RTMP fails, it will retry on port 80.

So, how can I block 1935 in iptables to force RTMP to go through a normal HTTP port?

I have the following but it is not working.

Any RTMP streams still fail.

[root@li711-43 ~]# iptables -A INPUT -p tcp --destination-port 1935 -j DROP
[root@li711-43 ~]# iptables -A OUTPUT -p tcp --dport 1935 -j DROP

1 Answer 1

0

So, how can I block 1935 in iptables to force RTMP to go through a normal HTTP port?

Use the PREROUTING chain:

iptables -t nat -I PREROUTING -p tcp --dport 1935 -j REDIRECT --to-ports 80

But that said, you also say this:

We have a proxy filtering connections but some sites use RTMP, which runs on port 1935. This cannot go through the proxy as proxies are port 80 only.

So is port 1935 completely blocked? You would need to at least punch a hole in the FORWARD chain to allow 1935 to come through & then be sent to port 80 via the above PREROUTING rule:

iptables -A INPUT -p tcp -m tcp --dport 1935 -j ACCEPT

Or if iptables is going to forward that traffic to another machine, you need to set that IP like this; replacing 123.45.67.89 with the actual IP address of the destination machine:

iptables -A FORWARD -i eth0 -p tcp --dport 1935 -d 123.45.67.89 -j ACCEPT
1
  • rtmp will retry on port 80 if 1925 doesn't work, so is there any need to forward it to 80?
    – user3718057
    Jun 7, 2014 at 15:45

You must log in to answer this question.