- I have AWS VPC with 1 public subnet and 1 private subnet.
- I have my web-server running on port 80 in private subnet.
- I want this webserver be accessible form public internet
- Yes, The VPC security groups have correct configuration so this is not an issue.
- No, I don't want to use ELB or nginX/Haproxy. Lets not get into that discussion.
- I want to achieve this via IPtalbes. I want to have an instance with public IP address in public subnet which should act as a Linux router using iptables.
These are the commands I have run my instance which is in public subnet and has a public IP address.
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.1.132:80
10.0.1.132is the IP address of my web server sitting in private subnet.
eth0is the interface of my instance which is acting as a router and has a private IP address of
I have IP forwarding enables:
# sysctl -p net.ipv4.ip_forward = 1
and here is my iptables status:
# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere anywhere tcp dpt:http to:10.0.1.132:80 Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
Now, when I reach to public DNS of my Linux router, I don't get anything:
$ curl -IL ec2-54-201-38-205.us-west-2.compute.amazonaws.com HTTP/1.0 504 Gateway Time-out Server: squid/2.7.STABLE9 Date: Wed, 20 Nov 2013 10:22:57 GMT Content-Type: text/html Content-Length: 1145 X-Squid-Error: ERR_CONNECT_FAIL 61 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.0 localhost:3128 (squid/2.7.STABLE9) Connection: close
So it means, whatever I did is not working.
I was expecting that when I reach port 80 on my public facing Linux router, It should have redirected the request to port 80 of my internal web server but this is not working. What is wrong with my set up OR