DNAT to 127 fails

DNAT to 127 fails

[Jan Engelhardt]

Hi,


Connection from anywhere-on-the-internet (dsl0) to alphagate:80 only does not 
work when --to-dest is 127.0.0.1. It works with 192.168.44.1.
(It's not a bridge problem, that for sure!)
Why? Some routing problem?


iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest 127.0.0.1:8000

11:40 alphagate:/etc # route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
213.23.208.1    0.0.0.0         255.255.255.255 UH    0      0        0 dsl0
192.168.44.0    0.0.0.0         255.255.255.0   U     0      0        0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         213.23.208.1    0.0.0.0         UG    0      0        0 dsl0

11:42 alphagate:/etc # ip a l
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
6: br0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue
    link/ether 00:40:f4:79:b3:85 brd ff:ff:ff:ff:ff:ff
    inet 192.168.44.1/24 brd 192.168.44.255 scope global br0
19: dsl0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 3
    link/ppp
    inet 213.23.218.138 peer 213.23.208.1/32 scope global dsl0



Jan Engelhardt
-- 

Re: DNAT to 127 fails

[Jörg Harmuth]

Jan Engelhardt schrieb:
> Hi,
> 
> 
> Connection from anywhere-on-the-internet (dsl0) to alphagate:80 only does not 
> work when --to-dest is 127.0.0.1. It works with 192.168.44.1.
> (It's not a bridge problem, that for sure!)
> Why? Some routing problem?
> 
> 
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest 127.0.0.1:8000

"-j DNAT" is not intended to DNAT to localhost. The REDIRECT target is
for this. From "man iptables":

REDIRECT
       This  target  is  only  valid  in the nat table, in the
       PREROUTING and OUTPUT chains, and user-defined chains
       which are only called from those chains.  It redirects
       the packet to the machine itself  by  changing  the
       destination  IP  to  the  primary  address of the incoming
       interface (locally-generated packets are mapped to the 127.0.0.1
       address).  It takes one option:

       --to-ports port[-port]
              This specifies a destination port or range of ports to
              use: without this,  the  destination  port is never
              altered.  This is only valid if the rule also specifies
              -p tcp or -p udp.

Have a nice time,

Joerg

Re: DNAT to 127 fails

[Jan Engelhardt]

>"-j DNAT" is not intended to DNAT to localhost. The REDIRECT target is
>for this. From "man iptables":

I guess this has to do with the recent 2.6.11->12 change that there is no more 
implicit SNAT on -j DNAT, right? (Before, -j REDIRECT --to-ports ports was 
equal to -j DNAT --to-dest 127.0.0.1:ports)



Jan Engelhardt
-- 
| Alphagate Systems, http://alphagate.hopto.org/

Re: DNAT to 127 fails

[Jörg Harmuth]

Jan Engelhardt schrieb:
>>"-j DNAT" is not intended to DNAT to localhost. The REDIRECT target is
>>for this. From "man iptables":
> 
> 
> I guess this has to do with the recent 2.6.11->12 change that there is no more 
> implicit SNAT on -j DNAT, right? (Before, -j REDIRECT --to-ports ports was 
> equal to -j DNAT --to-dest 127.0.0.1:ports)

Don't know, but with my 2.4.31 it doesn't work too (maybe a backport ?).
Only -j REDIRECT works.

Have a nice time,

Joerg