Home / server / Questions / 997547
Accepted
hbquikcomjamesl
Asked: 2020-01-04 11:13:15 +0800 CST

Port forwarding/mapping on AWS without a load balancer -- how did I do it?

  • 772

I've got a real puzzle on my hands.

I've got a single Amazon EC2 instance, that I set up around 6 months ago. It's running an Apache HTTPD on ports 81 (unsecured) and 8000 (secured). It's also running a Tomcat on port 8443. But the outside world sees Tomcat (secured) on 443.

There's no load balancer involved (we have load balanced clusters; I know what that looks like).

The Tomcat and HTTPD servers are running independently of each other.

If I do a netstat on the EC2 instance, it shows that it's listening on 8443, but not 443. The active connector in the Tomcat's server.xml includes a "proxyPort" clause for 443.

If I do a curl from my desktop to the Tomcat server, on 443, I get something back. If I do a curl from the EC2 instance to localhost, on 443, I get nothing; if I do so on 8443, I get a complaint about the cert being wrong for "localhost," so it's obviously connecting. So apparently, the mapping between 443 and 8443 is external to the instance.

And like a complete idiot, I left myself no notes whatsoever on what I did to make this thing work. Can anybody tell me what I did, and how I did it? Or at least tell me what to look for? I see a security group, but it doesn't say anything about remapping any ports.

amazon-web-services

2 Answers

  1. Best Answer

    Is it done with iptables?

    Run iptables-save and look for a port mapping between 443 and 8443. Maybe iptables-save | grep 443 for start.

    Hope that helps :)

    • 2

  2. MLu said:

    obviously all the commands I mentioned are privileged,

    AHA! Thanks! After adopting root privileges, "iptables -L" still produces nothing but column headings, but iptables-save produces this:

    # Generated by iptables-save v1.4.18 on Mon Jan  6 21:17:22 2020
*filter
:INPUT ACCEPT [5018099:5766179544]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4555500:2863742410]
COMMIT
# Completed on Mon Jan  6 21:17:22 2020
# Generated by iptables-save v1.4.18 on Mon Jan  6 21:17:22 2020
*nat
:PREROUTING ACCEPT [41828:2351495]
:INPUT ACCEPT [76356:4167904]
:OUTPUT ACCEPT [254990:18418937]
:POSTROUTING ACCEPT [254990:18418937]
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
COMMIT
# Completed on Mon Jan  6 21:17:22 2020

    I think I found something. Not quite sure what it is, though, or how I put it there.

    • 0