Home / server / Questions / 211536
In Process
Chris
Asked: 2010-12-12 03:41:46 +0800 CST

iptables port redirect not working for localhost

  • 772

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables:

iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \
         --dport 443 -j REDIRECT --to-ports 8080

This works for all external clients. But if I'm trying to access the port 443 from the same maschine I'll get a connection refused error.

wget https://localhost

How can I extend the iptables rule to redirect local traffic too?

firewall linux port-forwarding iptables

4 Answers

  1. PREROUTING isn't used by the loopback interface, you need to also add an OUTPUT rule:

    iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080
iptables -t nat -I OUTPUT -p tcp -o lo --dport 443 -j REDIRECT --to-ports 8080
    • 77

  2. To redirect packets from localhost to another machine the rule:

     iptables -t nat -A OUTPUT -o lo -d 127.0.0.1 -p tcp --dport 443 -j DNAT  --to-destination 10.x.y.z:port

    will work, BUT you also need to enable this option in the kernel:

    sysctl -w net.ipv4.conf.all.route_localnet=1

    Without that kernel setting it wont work.

    • 13

  3. How about this?

    iptables -t nat -A OUTPUT -d 127.0.0.1 -p tcp --dport 443 -j REDIRECT --to-port 8080

    • 3

  4. You said you are getting connection refused error. This means that there is no local process listening on the port you are trying to connect to! To check the listening processes, use the command:

    $ sudo netstat -lnp | grep 8080

    After applying the rule, you should have a process listening on the port 8080 to get connected.

    It seems that you should have the following rule instead:

    $ iptables -t nat -I OUTPUT --source 0/0 --destination 0/0 -p tcp
                                       --dport 443 -j REDIRECT --to-ports 8080

    Remember that you are sending from the localhost. So, you need to redirect the output packet.

    • 2