4

There are two IPs associated with one physical network interface eth0 and eth0:0.

The following works fine for the first interface:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Howerver the same doesn't work for the second interface:

iptables -A PREROUTING -t nat -i eth0:0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Also tried:

iptables -A PREROUTING -t nat -p tcp --dport 80 -d $THE_IP -j REDIRECT --to-port 8080

So the question is how to do redirecting on a virtual interface.

3 Answers 3

5

You don't. Alias interfaces are a notational convention that don't actually exist at the deep layers of the kernel where iptables roams. Use an IP address (your third example command is broken and will have produced an error message which should have clued you in) and all will be well.

7
  • edited the 3rd command to the one I've used and there is no error and redirection still doesn't work. Could you also elaborate on why nating based on the incoming interface is dangerous?
    – f3r3nc
    Jul 5, 2012 at 18:04
  • If that third command doesn't work, something else is wrong, because I use the exact same command and it works for me. Time to break out the TRACE target and see what you can see.
    – womble
    Jul 5, 2012 at 18:12
  • Well, TRACE target? could you be more specific?
    – f3r3nc
    Jul 5, 2012 at 18:37
  • I could. Can you read a manpage?
    – womble
    Jul 5, 2012 at 18:44
  • omg, this is rtfm all over the place.. :(
    – f3r3nc
    Jul 6, 2012 at 9:21
1

Your third command is missing something : the enabling of multiport Add -m multiportat the begining so it will be ok. + it is suposed to be --dports and --to-ports(plural form) even if you specify only a single port

Note that I had a similar problem + I already had an application using port 80 (apache2) that I had to kill before being able to use the redirection

0

You should use TUN/TAP interface for doing this work. Refer to this tutorial for further details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .