The situation: I need clients to be able to hit an HTTP server running on eth1 interface on a Linux box on port 8080. I don't want the clients to have to do anything special and I don't want to give the HTTP server access to privileged ports.
I'm well aware of how to setup a simple NAT prerouting rule on Linux iptables to redirect ports. For example, to redirect packets hitting port 80 to 8080, you'd do:
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080
This works quite well on a simple Linux box running eth0. However, I'm trying to implement this on a Linux box with two Ethernet interfaces (eth0 and eth1), each running a different subnet. For example:
eth0 10.10.20.0/24 eth1 10.10.30.0/24
I've setup the iptables nat prerouting rules and yet clients cannot hit the app as expected. I'm assuming it has something to do with the fact that the box is running two ethernet interfaces, but I can't pinpoint the problem. In fact, my rules are specific enough and I still can't get it working. Anyone have some insight into how I can troubleshoot this:
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-ports 8080
It should be noted that clients are coming from the same subnet as eth1 and with the iptables rules in place, clients cannot connect to port 80. My goal is to allow an HTTP server running on port 8080 so I don't have to allow root access to privileged ports and so clients don't have to enter in port 8080.
Thanks in advance!