1

I have a simple iptables setup that isn't quite right, and I'd love to know why it works this way and what I can do to get this working. Here are my rules:

# redirect 80 to site
sudo iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to 8080

sudo iptables -A INPUT -s 127.0.0.1 -j ACCEPT # local is good
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # stuff from me is good 
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT # ssh is good
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # and so is web
sudo iptables -A INPUT -j DROP # culprit?

So the port forwarding from 80 to 8080 is cool, until I add the last DROP rule. When I do I get timeouts on the request. Is there something I have to chain to get the drop and the prerouting to work together, or is the mistake something else? Thanks for your help.

8

Most helpful tool concerning iptables EVER:

http://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg

See that -t nat -A PREROUTING gets applied to the packet before it reaches the INPUT chain. So, ACCEPT --dport 8080 instead of --dport 80.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.