0

I've a single box with Tomcat listening on 127.0.0.1:8780 and I just want all the HTTP traffic be redirected to that port. It works from localhost, but it doesn't from another machine in the same (virtual) LAN.

For now I deliberately allow all inbound traffic in order to find the right NAT configuration, later I am planning to start blocking some ports and leave HTTP 80 open.

root@box1:~$ netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:8780          0.0.0.0:*               LISTEN      779/java               
udp        0      0 0.0.0.0:29411           0.0.0.0:*                           419/dhclient    
udp        0      0 0.0.0.0:68              0.0.0.0:*                           419/dhclient    
udp6       0      0 :::56705                :::*                                419/dhclient    
iptables -N RULE_0
iptables -A OUTPUT  -m state --state NEW  -j RULE_0
iptables -A INPUT  -m state --state NEW  -j RULE_0
iptables -A FORWARD  -m state --state NEW  -j RULE_0
iptables -A RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
iptables -A RULE_0  -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8780
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8780
root@box1:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RULE_0     all  --  anywhere             anywhere             state NEW

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RULE_0     all  --  anywhere             anywhere             state NEW

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
RULE_0     all  --  anywhere             anywhere             state NEW

Chain RULE_0 (3 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             LOG level info prefix "RULE 0 -- ACCEPT "
LOG        all  --  anywhere             anywhere             LOG level info prefix "RULE 0 -- ACCEPT "
ACCEPT     all  --  anywhere             anywhere            
root@box1:/etc/halo# nc localhost 80; echo $?
0
usr@box2:~$ nc box1 80; echo $?
box1 [192.168.56.100] 80 (http) : Connection timed out
1
usr@box2:~$ ping box1
PING box1 (192.168.56.100) 56(84) bytes of data.
64 bytes from box1 (192.168.56.100): icmp_seq=1 ttl=63 time=0.985 ms
64 bytes from box1 (192.168.56.100): icmp_seq=2 ttl=63 time=0.972 ms
64 bytes from box1 (192.168.56.100): icmp_seq=3 ttl=63 time=0.945 ms
64 bytes from box1 (192.168.56.100): icmp_seq=4 ttl=63 time=0.905 ms
^C
--- box1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 0.905/0.951/0.985/0.048 ms
1

Your tomcat listens on localhost: 127.0.0.1:8780, while you try to connect to box1, which has a different ip address: 192.168.56.100

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 127.0.0.1:8780
echo 1 > /proc/sys/net/ipv4/conf/eth0/route_localnet

Where eth0 is your external interface.

  • Nice I didn't know about this toggle – A.B Oct 30 '17 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.