How to NAT inbound external traffic from port 80 to a local different port using iptables?

Question

I've a single box with Tomcat listening on 127.0.0.1:8780 and I just want all the HTTP traffic be redirected to that port. It works from localhost, but it doesn't from another machine in the same (virtual) LAN.

For now I deliberately allow all inbound traffic in order to find the right NAT configuration, later I am planning to start blocking some ports and leave HTTP 80 open.

root@box1:~$ netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:8780          0.0.0.0:*               LISTEN      779/java               
udp        0      0 0.0.0.0:29411           0.0.0.0:*                           419/dhclient    
udp        0      0 0.0.0.0:68              0.0.0.0:*                           419/dhclient    
udp6       0      0 :::56705                :::*                                419/dhclient    

iptables -N RULE_0
iptables -A OUTPUT  -m state --state NEW  -j RULE_0
iptables -A INPUT  -m state --state NEW  -j RULE_0
iptables -A FORWARD  -m state --state NEW  -j RULE_0
iptables -A RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- ACCEPT "
iptables -A RULE_0  -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8780
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8780

root@box1:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RULE_0     all  --  anywhere             anywhere             state NEW

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RULE_0     all  --  anywhere             anywhere             state NEW

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
RULE_0     all  --  anywhere             anywhere             state NEW

Chain RULE_0 (3 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             LOG level info prefix "RULE 0 -- ACCEPT "
LOG        all  --  anywhere             anywhere             LOG level info prefix "RULE 0 -- ACCEPT "
ACCEPT     all  --  anywhere             anywhere            

root@box1:/etc/halo# nc localhost 80; echo $?
0

usr@box2:~$ nc box1 80; echo $?
box1 [192.168.56.100] 80 (http) : Connection timed out
1

usr@box2:~$ ping box1
PING box1 (192.168.56.100) 56(84) bytes of data.
64 bytes from box1 (192.168.56.100): icmp_seq=1 ttl=63 time=0.985 ms
64 bytes from box1 (192.168.56.100): icmp_seq=2 ttl=63 time=0.972 ms
64 bytes from box1 (192.168.56.100): icmp_seq=3 ttl=63 time=0.945 ms
64 bytes from box1 (192.168.56.100): icmp_seq=4 ttl=63 time=0.905 ms
^C
--- box1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 0.905/0.951/0.985/0.048 ms

Answer 1

Your tomcat listens on localhost: 127.0.0.1:8780, while you try to connect to box1, which has a different ip address: 192.168.56.100

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 127.0.0.1:8780
echo 1 > /proc/sys/net/ipv4/conf/eth0/route_localnet

Where eth0 is your external interface.