0

I have a webserver that runs as normal user so I can't use ports below 1024. The webserver should still be accessed at port 443. I want iptables to port forward 443 to 1443 where my webserver listens to incoming requests. These are so far my rules:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A OUTPUT -p tcp -o eth0 --sport 443 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 443 -j ACCEPT

iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-port 1443 
iptables -A OUTPUT -t nat -p tcp --dport 443 -j REDIRECT --to-port 1443

But iptables still drops the packets unless I add the following rules:

iptables -A OUTPUT -p tcp -o eth0 --sport 1443 -j ACCEPT
iptables -A INPUT -p tcp -i eth0 --dport 1443 -j ACCEPT

Now I can reach my webserver at port 443, but also at port 1443 which I don't want.

What rules am I missing so my webserver is only accessible at port 443?

3
  • Common webservers start as root, bind the necessary ports, and then change their user to their running non-root user. Yours should also do this. – Michael Hampton Jan 15 '19 at 15:41
  • Is it possible to change the user of the running webserver process? – D. Smith Jan 16 '19 at 6:51
  • All normal web servers are configurable, but you'll have to ask the developer of whatever strange server you are running. – Michael Hampton Jan 16 '19 at 14:44
1

I think the easiest way to achieve that would be:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-port 1443 

iptables -A INPUT --ctstate ESTABLISHED,DNAT -j ACCEPT
iptables -A OUTPUT --ctstate ESTABLISHED -j ACCEPT
2
  • I get 'Bad state "DNAT"', is my kernel too old or am I missing a kernel config option? Kernel is 2.6.28 – D. Smith Jan 16 '19 at 6:46
  • It is probably too old. You can check iptables or iptables-extensions man page to see if it is listed as one of the states supported by conntrack module. In this case the other answer gives a very good hint about how to not expose the other port to the outside world. – Tomek Jan 16 '19 at 7:02
0

Easiest way to fix it, configure your Web-server to listen only on localhost(127.0.0.1), configure iptables rules for input:

iptables -A INPUT -p tcp -d 127.0.0.1/32 -i eth0 --dport 1443 -j ACCEPT

And forward all request to 127.0.0.1:1443.

3
  • How would the rule to forward all port 443 requests to 127.0.0.1:1443 look like? iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 127.0.0.1:1443 did not work for me. – D. Smith Jan 15 '19 at 12:53
  • @D.Smith, check this question. – Alexander Tolkachev Jan 15 '19 at 13:07
  • the accepted answer of the link you provided tells me to set route_localnet=1, but my kernel is too old and does not have this kernel parameter. – D. Smith Jan 15 '19 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.