0

I have a webserver that runs as normal user so I can't use ports below 1024. The webserver should still be accessed at port 443. I want iptables to port forward 443 to 1443 where my webserver listens to incoming requests. These are so far my rules:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A OUTPUT -p tcp -o eth0 --sport 443 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 443 -j ACCEPT

iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-port 1443 
iptables -A OUTPUT -t nat -p tcp --dport 443 -j REDIRECT --to-port 1443

But iptables still drops the packets unless I add the following rules:

iptables -A OUTPUT -p tcp -o eth0 --sport 1443 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 1443 -j ACCEPT

Now I can reach my webserver at port 443, but also at port 1443 which I don't want.

What rules am I missing so my webserver is only accessible at port 443?

Improve this question
3
  • Common webservers start as root, bind the necessary ports, and then change their user to their running non-root user. Yours should also do this.
    – Michael Hampton
    Jan 15, 2019 at 15:41
  • Is it possible to change the user of the running webserver process?
    – D. Smith
    Jan 16, 2019 at 6:51
  • All normal web servers are configurable, but you'll have to ask the developer of whatever strange server you are running.
    – Michael Hampton
    Jan 16, 2019 at 14:44

2 Answers 2

Reset to default
1

I think the easiest way to achieve that would be:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-port 1443 

iptables -A INPUT --ctstate ESTABLISHED,DNAT -j ACCEPT
iptables -A OUTPUT --ctstate ESTABLISHED -j ACCEPT
Improve this answer
2
  • I get 'Bad state "DNAT"', is my kernel too old or am I missing a kernel config option? Kernel is 2.6.28
    – D. Smith
    Jan 16, 2019 at 6:46
  • It is probably too old. You can check iptables or iptables-extensions man page to see if it is listed as one of the states supported by conntrack module. In this case the other answer gives a very good hint about how to not expose the other port to the outside world.
    – Tomek
    Jan 16, 2019 at 7:02
0

Easiest way to fix it, configure your Web-server to listen only on localhost(127.0.0.1), configure iptables rules for input:

iptables -A INPUT -p tcp -d 127.0.0.1/32 -i eth0 --dport 1443 -j ACCEPT

And forward all request to 127.0.0.1:1443.

Improve this answer
3
  • How would the rule to forward all port 443 requests to 127.0.0.1:1443 look like? iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 127.0.0.1:1443 did not work for me.
    – D. Smith
    Jan 15, 2019 at 12:53
  • @D.Smith, check this question.
    – Alexander Tolkachev
    Jan 15, 2019 at 13:07
  • the accepted answer of the link you provided tells me to set route_localnet=1, but my kernel is too old and does not have this kernel parameter.
    – D. Smith
    Jan 15, 2019 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .