4

There are two IPs associated with one physical network interface eth0 and eth0:0.

The following works fine for the first interface:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Howerver the same doesn't work for the second interface:

iptables -A PREROUTING -t nat -i eth0:0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Also tried:

iptables -A PREROUTING -t nat -p tcp --dport 80 -d $THE_IP -j REDIRECT --to-port 8080

So the question is how to do redirecting on a virtual interface.

5

You don't. Alias interfaces are a notational convention that don't actually exist at the deep layers of the kernel where iptables roams. Use an IP address (your third example command is broken and will have produced an error message which should have clued you in) and all will be well.

  • edited the 3rd command to the one I've used and there is no error and redirection still doesn't work. Could you also elaborate on why nating based on the incoming interface is dangerous? – f3r3nc Jul 5 '12 at 18:04
  • If that third command doesn't work, something else is wrong, because I use the exact same command and it works for me. Time to break out the TRACE target and see what you can see. – womble Jul 5 '12 at 18:12
  • Well, TRACE target? could you be more specific? – f3r3nc Jul 5 '12 at 18:37
  • I could. Can you read a manpage? – womble Jul 5 '12 at 18:44
  • omg, this is rtfm all over the place.. :( – f3r3nc Jul 6 '12 at 9:21
1

Your third command is missing something : the enabling of multiport Add -m multiportat the begining so it will be ok. + it is suposed to be --dports and --to-ports(plural form) even if you specify only a single port

Note that I had a similar problem + I already had an application using port 80 (apache2) that I had to kill before being able to use the redirection

0

You should use TUN/TAP interface for doing this work. Refer to this tutorial for further details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.