0

I'm running cPanel/WHM with ConfigServer Firewall (csf).

I want to forward port 8080 on my webserver to an internal server with an IP of lets say 10.1.1.1 thats running a webserver on port 80. How can I do this?

My WAN ip is running on eth0 The internal server is connected using the eth1 interface.

What would be the appropriate IPtables cmd to do this?

Improve this question
1

2 Answers 2

Reset to default
2

Something like this should work

sudo /sbin/iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.1.1.1:80

If you haven't already done so you may need to enable IP forwarding too

/sbin/sysctl -w net.ipv4.ip_forward=1

and to make it permanent edit /etc/sysctl.conf and set 

net.ipv4.ip_forward = 1

EDIT:

As the policy on your FORWARD chain is DROP you will need to allow packets through. I don't think your current FORWARD rule is doing anything helpful so delete it.

Enable packets sent to FORWARD from eth0:8080 to be sent to 10.1.1.1

/sbin/iptables -I FORWARD  -p tcp -m tcp  -d 10.1.1.1 --destination-port 80 -j ACCEPT

Allow packets to go the other way too

/sbin/iptables -I FORWARD -i eth1 -p tcp -m tcp -j ACCEPT

You mat want to restrict the latter further.

Improve this answer
9
  • Will that actually working considering the 10.1.1.1 ip is on eth1?
    – William Balkcom
    Jul 11, 2011 at 22:37
  • Didn't seem to work.
    – William Balkcom
    Jul 12, 2011 at 0:00
  • @WilliamBalkcom: yes, you are routing packets from eth0:8080 -> 10.1.1.1:80 or at leasts that's what you requests. This works on a test system I have. Check that you have something listening on 10.1.1.1:80. Is 10.1.1.1 running a firewall and is it allowing connections on port 80 ? Check that your FORWARD chain is allowing packets.
    – user9517
    Jul 12, 2011 at 6:55
  • I have a webserver listening on 10.1.1.1:80, it is allowing all connections. The connection to 10.1.1.1 is established through eth1 and eth1 is configured like this: gyazo.com/42a58b08b6d2dcbd1bee2b5148a478e6.png And actually the IP is 10.1.3.98, just using 10.1.1.1 as an example.
    – William Balkcom
    Jul 12, 2011 at 7:11
  • @WilliamBalkcom: please post the (suitably redacted) output of iptables -l -v -n and iptables -t nat -L -v -n
    – user9517
    Jul 12, 2011 at 8:29
0

Something like:

iptables -A PREROUTING -t nat -i eth1 -p tcp \ 
  --dport 8888 -j DNAT --to 10.1.1.1:80

Sends forwards the requests on port 8888.

iptables -A INPUT -p tcp -m state --state NEW --dport 8888 -i eth1 -j ACCEPT

Allows incoming connections ton port 8888.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .