For load balancing purposes, occasionally our servers forward requests to a different port; The default port for our service is port 5000.

This is the code used: iptables -t nat -A PREROUTING -p tcp --dport 5000 -j REDIRECT --to-port 5001

After applying this code, the port forwarding works great for new requests.
New requests on port 5000 are forwarded to our service on port 5001. However, existing connections remain connected to port 5000, as displayed by netstat.

My question is, how do I force this iptables rule to immediately apply to all connections, both new and existing (established) - without dropping all connections first?

Thanks in advance

  • 2
    You can't do that. What are you actually trying to accomplish? – Michael Hampton Feb 6 '14 at 22:44
  • That doesn't make any sense. How could the local endpoint of the connection possibly handle such a change? – David Schwartz Feb 7 '14 at 4:17

The existing connections stay connected because iptables NAT tracks the state of connections-- that is, it's "stateful".

The iptables tools won't let you modify the state of existing connections. Even if you could somehow modify the existing connections in the iptables NAT connection tracking table, how would you alert the remote clients to change the port they're communicating with? That's the rub-- there's no functionality in the TCP protocol to tell a remote client "change to port number ###". That's just not part of the protocol (and since it isn't there's no reason for iptables to let you do what you're asking for).

  • Okay thanks for clearing that up, I was hoping I wouldn't have to write a relay proxy, and use IPtables instead, but alas. – Joni Chicago Feb 6 '14 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.