0

I try to use iptables to keep Varnish on port 8080 and Apache on port 80 and just preroute everything coming in at port 80 to port 8080. It isn't working. When I call the site on port 8080 everything is cached and fine, when I call it on port 80 I just get the normal Apache response.

I follow this guide.

So Varnish and Apache seem to be configured correctly, since I receive a cached version on port 8080.

In step 1 I just add the rule to iptables:

#iptables -t nat  -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

When I then call 

#iptables -L -t nat

to see if it worked, I receive this output:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:http redir ports 8080

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The output from iptables-save:

# Generated by iptables-save v1.4.12 on Mon Oct 27 23:24:03 2014
*raw
:PREROUTING ACCEPT [22819:7234594]
:OUTPUT ACCEPT [32677:42807068]
COMMIT
# Completed on Mon Oct 27 23:24:03 2014
# Generated by iptables-save v1.4.12 on Mon Oct 27 23:24:03 2014
*nat
:PREROUTING ACCEPT [40:2416]
:POSTROUTING ACCEPT [64:3751]
:OUTPUT ACCEPT [64:3751]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
COMMIT
# Completed on Mon Oct 27 23:24:03 2014
# Generated by iptables-save v1.4.12 on Mon Oct 27 23:24:03 2014
*mangle
:PREROUTING ACCEPT [22821:7234698]
:INPUT ACCEPT [22821:7234698]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32696:42835416]
:POSTROUTING ACCEPT [32696:42835416]
COMMIT
# Completed on Mon Oct 27 23:24:03 2014
# Generated by iptables-save v1.4.12 on Mon Oct 27 23:24:03 2014
*filter
:INPUT ACCEPT [22821:7234698]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32696:42835416]
COMMIT
# Completed on Mon Oct 27 23:24:03 2014

So it should be fine. What am I missing?? Thanks!

Improve this question

1 Answer 1

Reset to default
2

You should be fine -- I'm guessing you're testing the redirect from the machine running Varnish.

On my server running Apache, I can redirect 8080 calls to port 80 (reverse of what you're trying).

On server 10.3.1.10:

To test my apache exists on port 80 I use netcat to get the web page:

root@hp:/etc/apt# nc 10.3.1.10 80
get
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>501 Not Implemented</title>
</head><body>
<h1>Not Implemented</h1>
<p>get to /index.html not supported.<br />
</p>
<hr>
<address>Apache/2.4.7 (Ubuntu) Server at 127.0.1.1 Port 80</address>
</body></html>
root@hp:/etc/apt#

That is good -- now add my redirect:

iptables -t nat  -A PREROUTING -i eth0 -p tcp --dport 8080 -j REDIRECT --to-ports 80

This specifies in eth0, protocol tcp destination 8080 redirect to 80.

And test netcat on port 8080:

root@hp:/etc/apt# nc 10.3.1.10 8080
root@hp:/etc/apt#

No output -- didn't connect, but nothing is wrong and iptables shows no traffic on my redirect (pkts and bytes columns for the rule):

root@hp:/etc/apt# iptables -L -t nat -n -v
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REDIRECT   tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 redir ports 80

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

So what happened, nothing went though my rule -- but I am good.

Now I go to another machine (10.3.1.5) and run the same netcat command:

root@firewall:~# nc 10.3.1.10 8080
get
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>501 Not Implemented</title>
</head><body>
<h1>Not Implemented</h1>
<p>get to /index.html not supported.<br />
</p>
<hr>
<address>Apache/2.4.7 (Ubuntu) Server at 127.0.1.1 Port 80</address>
</body></html>

This seems to work -- checking my traffic on .10 with iptables:

root@hp:/etc/apt# iptables -L -t nat -n -v
Chain PREROUTING (policy ACCEPT 4 packets, 898 bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   120 REDIRECT   tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 redir ports 80

Chain INPUT (policy ACCEPT 6 packets, 1018 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

I see 2 packets, 120 bytes (I ran netcat twice).

The redirect won't work from the machine redirecting because you're not coming in eth0.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .