local port redirect to remote IP

local port redirect to remote IP

[Adam Wiggins]

Greetings,

I need to redirect a port on the loopback device to a remote IP -
basically the reverse of a transparent Squid proxy.

The example I'm trying to get working is to make port 8000 on the
local machine connect me to www.yahoo.com:80.

I tried both DNAT and REDIRECT (not sure which is applicable here),
as follows:

[root@ash root]# iptables -F -t nat
[root@ash root]# iptables -t nat -A PREROUTING -s 127.0.0.1 -p tcp --dport 8003 -j REDIRECT --to 64.58.76.225:80
[root@ash root]# telnet localhost 8003
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
[root@ash root]# iptables -F -t nat
[root@ash root]# iptables -t nat -A PREROUTING -s 127.0.0.1 -p tcp --dport 8003 -j DNAT --to 64.58.76.225:80
[root@ash root]# telnet localhost 8003
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

The REDIRECT works on a remote machine (if I specify -s <someIP> and
then connect from that machine), so I know I must be close.  I
experimented with POSTROUTING as well, but that doesn't allow you to
specify a source IP and I need to make sure this only works when
connecting locally.

Any pointers much appreciated.

-Adam

Re: local port redirect to remote IP

[Adam Wiggins]

Replying to my own post here.  Someone posted the link to this
excellent tutorial:

http://iptables-tutorial.frozentux.net/chunkyhtml/book1.html

Which gave me a lot of insight, but unfortunately still doesn't cover
the case I want (take packets originating on localhost, going to a
port on localhost, and NAT them to a remote box).

At the bottom of the DNAT explanation:

http://iptables-tutorial.frozentux.net/chunkyhtml/x2326.html#DNATTARGET

...it covers something that seems like what I want, which is DNATing
from a firewall to a web server inside a LAN:

iptables -t nat -A OUTPUT --dst $INET_IP --dport 80 -j DNAT --to-destination $HTTP_IP

Using the OUTPUT chain, which I hadn't tried.  So I did this:

iptables -t nat -A OUTPUT -p tcp --dst 127.0.0.1 --dport 8000 -j DNAT --to-destination 64.58.76.225:80

I think this is on the right track - now when I telnet to port 8000
locally it just locks waiting for the connection.  That implies that
the packets are getting sent out but failing to return.  I tried
switching --dst to be the machine's local IP, thinking that that might
help them find their way back more easily, but no dice.

Any thoughts?

-Adam



On Thu, Nov 07, 2002 at 06:57:21PM -0800, Adam Wiggins wrote:
> 
> Greetings,
> 
> I need to redirect a port on the loopback device to a remote IP -
> basically the reverse of a transparent Squid proxy.
> 
> The example I'm trying to get working is to make port 8000 on the
> local machine connect me to www.yahoo.com:80.
> 
> I tried both DNAT and REDIRECT (not sure which is applicable here),
> as follows:
> 
> [root@ash root]# iptables -F -t nat
> [root@ash root]# iptables -t nat -A PREROUTING -s 127.0.0.1 -p tcp --dport 8003 -j REDIRECT --to 64.58.76.225:80
> [root@ash root]# telnet localhost 8003
> Trying 127.0.0.1...
> telnet: connect to address 127.0.0.1: Connection refused
> [root@ash root]# iptables -F -t nat
> [root@ash root]# iptables -t nat -A PREROUTING -s 127.0.0.1 -p tcp --dport 8003 -j DNAT --to 64.58.76.225:80
> [root@ash root]# telnet localhost 8003
> Trying 127.0.0.1...
> telnet: connect to address 127.0.0.1: Connection refused
> 
> The REDIRECT works on a remote machine (if I specify -s <someIP> and
> then connect from that machine), so I know I must be close.  I
> experimented with POSTROUTING as well, but that doesn't allow you to
> specify a source IP and I need to make sure this only works when
> connecting locally.
> 
> Any pointers much appreciated.
> 
> -Adam
>