I am using iptables redirection to make a Tomcat on RHEL7 accessible on port 443 (for https traffic) as described here. The important rules should be those three:

 iptables -A INPUT -p tcp --dport 443 -i eth3 -j ACCEPT
 iptables -A INPUT -p tcp --dport 8443 -i eth3 -j ACCEPT
 iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-port 8443
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -i eth3 -j ACCEPT
 # Drop all other incoming packets on the interface eth3
 iptables -A INPUT -i eth3 -j DROP

So what I do not understand is why I need the rule to open port 8443 to the outside? When I close it and only open 443, it does not work. To my understanding the redirection should happen internally, doesn't it? Or can this be somehow configured differently?

Remark: eth3 is the one interface I actually do need to protect. There are others as well, but those are only internal ones.


I think I just figured it out myself: The pre-routing apparently happens before the actual accept/drop rules are being hit. Hence, the request is redirected from 443 to 8443 and the rules are only applied to the redirected traffic. Thus, I do not have to open port 443 with an accept rule. The redirect seems to "open" it anyway. So the first rule (accept 443) can be omitted.


I don't use Tomcat, but have you checked your Tomcat's port in the server.xml file? When I read at http://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html#Edit_the_Tomcat_Configuration_File it looks like may use port 8443 as standard. EDIT It is a connector port, not an internal redirection.

  • Of course it uses 8443 - and since I want it to stay there, I use the redirect rule. Running it on 443 would require root privs. – silent Nov 2 '16 at 15:41
  • But, if you want user to connect to 8443, you need to have it open. Maybe I don't understand you question? – raffe Nov 2 '16 at 15:50
  • The user connects through 443 from the outside. To my understanding the way the iptables redirect works is that everything else is handled internally. The user does not see that he is directed to port 8443. Hence I do not see why the firewall should need to be open. – silent Nov 2 '16 at 15:52
  • As I understand it, it works like when you use FTP with passive ports, it actually change to another port. – raffe Nov 2 '16 at 15:55
  • If you look under step 7 at crunchify.com/… , you see the URL ends with :8443. If you try your site and get the same, you use that port and therefore you need to have it open. – raffe Nov 2 '16 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.