The situation: I need clients to be able to hit an HTTP server running on eth1 interface on a Linux box on port 8080. I don't want the clients to have to do anything special and I don't want to give the HTTP server access to privileged ports.

I'm well aware of how to setup a simple NAT prerouting rule on Linux iptables to redirect ports. For example, to redirect packets hitting port 80 to 8080, you'd do:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

This works quite well on a simple Linux box running eth0. However, I'm trying to implement this on a Linux box with two Ethernet interfaces (eth0 and eth1), each running a different subnet. For example:

eth0 eth1

I've setup the iptables nat prerouting rules and yet clients cannot hit the app as expected. I'm assuming it has something to do with the fact that the box is running two ethernet interfaces, but I can't pinpoint the problem. In fact, my rules are specific enough and I still can't get it working. Anyone have some insight into how I can troubleshoot this:

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-ports 8080

It should be noted that clients are coming from the same subnet as eth1 and with the iptables rules in place, clients cannot connect to port 80. My goal is to allow an HTTP server running on port 8080 so I don't have to allow root access to privileged ports and so clients don't have to enter in port 8080.

Thanks in advance!

  • In case you applied a DROP policy for your ACCEPT chain, did you allowed port 8080 to go through ? – Spredzy May 28 '13 at 22:02
  • Although is your FORWARD chain && net.ipv4.ip_forward kernel parameter configured accordingly ? – Spredzy May 29 '13 at 8:46
  • Had not configured forward chain with any rules nor the sysctl parameter. Not forwarding packets, right? – beaconfield May 30 '13 at 18:09

Check your rules are being hit, by looking at the packet counters given by -

iptables -t nat -v -L -n

If your rules are being hit, are you sure your server knows the route back to clients who connect to it via eth1 ?

  • My rules were being hit, so my best guess is that there was some static route that needed implemented. – beaconfield May 30 '13 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.