Tag Info

Hot answers tagged

14

You can accomplish the redirection with iptables: iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080


8

I think what you want is: iptables -A FORWARD -m state -p tcp -d 192.168.1.200 --dport 8080 --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A PREROUTING -p tcp --dport 8001 -j DNAT --to-destination 192.168.1.200:8080


6

What you are searching for is called port forwarding. To enable port forwarding, you must log into your router and tell it that all unexpected incoming traffic from the network, on a certain port, is to be forwarded to that particular internal IP address. An analogy is that your router which performs NAT (network address translation) is like the front desk ...


5

iptables -t nat -A PREROUTING -d 1.1.1.1 -p tcp --dport 80 -j DNAT --to-destination 1.1.1.1:8080


5

ssh user@localhost won't work, at least not with the rules you've used. The PREROUTING chain works on packets coming into the machine, whereas if you're connecting to localhost, packets are being generated locally. The upside, though, is that your configuration should work for external connections. Have you tried it from somewhere else? Edit: This is a ...


5

You should look at using a reverse proxy, such as Nginx... e.g. put this in your nginx.conf file: server { listen 80; server_name your_ip_address your_server_name access_log /var/log/nginx/your_domain/access.log ; error_log /var/log/nginx/your_domain/error.log info ; location / { proxy_pass http://127.0.0.1:3000; ...


4

technically it's not possibly unless your router has a built in reverse proxy or some layer 7 routing which none that I know of do. If you want to really do it this way and want to make it scalable, then you will need to have a reverse proxy which has maps of site names and where to proxy it to. <VirtualHost *:80> ServerName www.domain-a1.com ...


3

A primary purpose of HTTPS is to prevent "man-in-the-middle", which is exactly what a transparent proxy like this is trying to do. To do so, you'd need to have a certificate valid for everything or a system to generate certificates on the fly. In either case you're going to need an internal CA (no already-trusted external one will give you a cert for ...


3

According to the manual, you may, on the public host, set the option (in sshd_config): GatewayPorts yes and then on local try ssh -R *:8000:localhost:22 user@public (note the extra *:). If you do not have access to public's sshd_config, you may make an extra port forward like so: on local (lancomp): ssh -R 8001:localhost:22 user@public on public: ssh ...


3

It's only useful if you have more than 1 public IP. Say you have 1.1.1.1 and 1.1.1.2 as your public IPs, you can then specify that if someone hits port 22 on 1.1.1.1 it will be forwarded to 192.168.0.1 and hitting port 22 on 1.1.1.2 wont (for example).


3

There are ways of doing this, like installing a mail forwarder on your web server. What I would do, though, is just point the MX record to mail.server.com and not bother with redirection. Because it introduces complexity that you don't really need to have. If something happens to your mail, you're going to have to take into account the interaction of your ...


3

Rinetd setup is easier I think.


3

Many routers don't support this sort of back-traversal. (Connecting to the outside from a machine on the inside.) That may be part of your problem. Further more: For telnet you need port 23, 22 is SSH and 21 (together with 20) is FTP. To check that the port-forwarding is actually working properly you can use something like ShieldsUp! (www.grc.com, Click on ...


3

SSH is really a generic secure communication mechanism which can transport arbitrary data over an insecure underlying channel. By default this data is a shell session (i.e. your local terminal is connected to a shell running on the remote system), but there are different types of data which can be transported. One such type is a stream socket connection ...


2

IF the host is never going to be using that interface, then you really shouldn't do anything on the host. Instead setup virtual box to bridge the virtual interface for your VM directly to that physical interface. Then setup your VM as if it was physically connected to whatever that interface was connected to.


2

If you add tunneling to your SSH session, there is an additional data stream created for the tunnel over the same encrypted connection. You also can create more than one tunnel or don't start an interactive session (with the -N parameter). So, basically, there is no real difference, just different methods to use the encrypted connection.


2

Works fine for me. A couple things to check: This won't NAT connections made from the VPN server itself, for this you need the rule in the OUTPUT chain. Is the client configured to route all traffic through the VPN? If not you may find that the response packets are not being sent back through the VPN. Are you sure you're using the client side IP address, ...


2

I think this cries out for "why would you do that?!" Just edit server1.com's DNS zone and add something like mail.server1.com A [server2'sIPAddress] and configure mail.server1.com as the MX record for the server1.com domain. There's nothing that says a server can't have more than one name, or even more than one domain. Keep in mind if you're paying for ...


2

Well, since you got the service up and running, there are a couple of things you may have to check, since you have centos running (I assume the 5 series). Make sure that iptables allows http traffic. If not, run: iptables -I INPUT 5 -m tcp -p tcp --dport 80 -j ACCEPT AND If you have SELinux running, you will need to enable http access. You can verify ...


2

If you just need to redirect all incoming traffic to a specified port forwarded to your another machine try rinetd instead of iptables. It's a traffic redirection server.


2

A stateful firewall can track UDP. It just creates an established connection for UDP once it has seen a packet coming from a masqueraded internal machine to an IP address on the internet. Any responding traffic is automatically forwarded to the internal machine.


1

iptables -t nat -A OUTPUT -p tcp --dport 12345 -j REDIRECT --to-ports 54321 12345 is a port your program tries to connect to 54321 is your proxy server port You can also specify additional options like "-m owner --uid-owner qqq" to redirect only connections of user qqq or "-d 11.22.33.44" to redirect only connections intended for host 11.22.33.44. The ...


1

On most of your higher end Routers you can specify Forward Wan traffic on this port to this IP address or Forward all traffic on this port to this IP address What make and model Router are you using?, check to see if it has the ability to set the All traffic option, if it does, tell everyone to stop using the internal IP and only use the External. HTH


1

You can double-chain SSH port forwards, bit a slightly easier method is to set up a "proxy" config in .ssh/config: Host *%proxy ProxyCommand ssh proxy-user@proxy.host "nc -w1 $(echo %h | cut -d%% -f1) 22" ForwardAgent yes StrictHostKeyChecking no Then use ssh -L 3306:127.0.0.1:3316 final-user@final.host%proxy to bring up the seesion. I use ...


1

It is not possible to do this directly. You need to setup another web server at port 80 and set reverse proxy to localhost:82.


1

The DNS system has nothing to do with ports, so you wouldn't be able to do it there. If no port is given, a browser will always connect to port 80 for HTTP connections. Any other port used needs to be explicitly specified in the URL, you can't transparently use another port. If you want to be able to type http://localhost into your browser and have a ...


1

In step 3 you mentioned /etc/apache2/sites-enabled/example.com <VirtualHost 1.2.3.4:80> ServerName example.com:8001 ... </VirtualHost> Which is not correct. It should be <VirtualHost 1.2.3.4:8001> ServerName example.com ... </VirtualHost>


1

The simplest answer is that port-forwarding (as in NAT) is generally transparent to the client, while a SOCKS (or HTTP) proxy requires the client to explicitly use the proxy protocol.



Only top voted, non community-wiki answers of a minimum length are eligible