Masquerading on local ports

Masquerading on local ports

[Henry Ritzlmayr]

Hi everyone - this is my first post to this list - so if anything is
wrong with my way of posting please tell.

And here is the question. How is it possible to nat a lokal port?

IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 --destination-port 81
-j DNAT --to-destination 127.0.0.1:80

telnet localhost 80  <<< works
telnet localhost 81  <<< Connection refused

Henry

RE: Masquerading on local ports

[Rob Sterenborg]

> And here is the question. How is it possible to nat a lokal port?
> 
> IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 
> --destination-port 81 -j DNAT --to-destination 127.0.0.1:80
> 
> telnet localhost 80  <<< works
> telnet localhost 81  <<< Connection refused

iptables -t nat -A PREROUTING -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT
--to-ports 81


Rob

RE: Masquerading on local ports

[henry ritzlmayr]

Am Don, 2003-03-20 um 16.29 schrieb Rob Sterenborg:
> > And here is the question. How is it possible to nat a lokal port?
> > 
> > IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 
> > --destination-port 81 -j DNAT --to-destination 127.0.0.1:80
> > 
> > telnet localhost 80  <<< works
> > telnet localhost 81  <<< Connection refused
> 
> iptables -t nat -A PREROUTING -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT
> --to-ports 81
> 
> 
> Rob

Tanks for the answer,
I tried that one already but it behaves the same.
I also tried 

IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12 --destination-port
81 -j REDIRECT --to-ports 80

wich works perfect for both port 80 and 81 from a foreign host.

Henry

RE: Masquerading on local ports

[Henry Ritzlmayr]

Am Don, 2003-03-20 um 16.29 schrieb Rob Sterenborg:
> > And here is the question. How is it possible to nat a lokal port?
> > 
> > IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 
> > --destination-port 81 -j DNAT --to-destination 127.0.0.1:80
> > 
> > telnet localhost 80  <<< works
> > telnet localhost 81  <<< Connection refused
> 
> iptables -t nat -A PREROUTING -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT
> --to-ports 81
> 
> 
> Rob

Tanks for the answer,
I tried that one already but it behaves the same.
I also tried 

IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12 --destination-port
81 -j REDIRECT --to-ports 80

wich works perfect for both port 80 and 81 from a foreign host.

Henry

RE: Masquerading on local ports

[alexb]

This one works for me:

iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 81 \
         -j REDIRECT --to-ports 80

Alex

Cópia Henry Ritzlmayr <h.ritzlmayr@gmx.at>:

> Am Don, 2003-03-20 um 16.29 schrieb Rob Sterenborg:
> > > And here is the question. How is it possible to nat a lokal port?
> > > 
> > > IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 
> > > --destination-port 81 -j DNAT --to-destination 127.0.0.1:80
> > > 
> > > telnet localhost 80  <<< works
> > > telnet localhost 81  <<< Connection refused
> > 
> > iptables -t nat -A PREROUTING -d 127.0.0.1 -p tcp --dport 80 -j
> REDIRECT
> > --to-ports 81
> > 
> > 
> > Rob
> 
> Tanks for the answer,
> I tried that one already but it behaves the same.
> I also tried 
> 
> IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12
> --destination-port
> 81 -j REDIRECT --to-ports 80
> 
> wich works perfect for both port 80 and 81 from a foreign host.
> 
> Henry
> 
> 

Re: Masquerading on local ports

[Joel Newkirk]

On Thursday 20 March 2003 09:03 am, Henry Ritzlmayr wrote:
> Hi everyone - this is my first post to this list - so if anything is
> wrong with my way of posting please tell.
>
> And here is the question. How is it possible to nat a lokal port?
>
> IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 --destination-port
> 81 -j DNAT --to-destination 127.0.0.1:80
>
> telnet localhost 80  <<< works
> telnet localhost 81  <<< Connection refused
>
> Henry

Packets originating on the local box never go through the PREROUTING 
chains.  This is why there is an OUTPUT chain in the nat table.  (and 
the mangle table)

iptables -t nat -A OUTPUT -o lo -p tcp --dport 81 -j DNAT --to 
127.0.0.1:80

should do it.  I'm not sure if the REDIRECT target would work properly 
for this use (localhost->localhost), but you can try easily enough.

j

Re: Masquerading on local ports

[Henry Ritzlmayr]

Am Fre, 2003-03-21 um 08.22 schrieb Joel Newkirk:
> On Thursday 20 March 2003 09:03 am, Henry Ritzlmayr wrote:
> > Hi everyone - this is my first post to this list - so if anything is
> > wrong with my way of posting please tell.
> >
> > And here is the question. How is it possible to nat a lokal port?
> >
> > IPTABLES -t nat -A PREROUTING -p tcp -d 127.0.0.1 --destination-port
> > 81 -j DNAT --to-destination 127.0.0.1:80
> >
> > telnet localhost 80  <<< works
> > telnet localhost 81  <<< Connection refused
> >
> > Henry
> 
> Packets originating on the local box never go through the PREROUTING 
> chains.  This is why there is an OUTPUT chain in the nat table.  (and 
> the mangle table)
> 
> iptables -t nat -A OUTPUT -o lo -p tcp --dport 81 -j DNAT --to 
> 127.0.0.1:80
> 
> should do it.  I'm not sure if the REDIRECT target would work properly 
> for this use (localhost->localhost), but you can try easily enough.
> 
> j

That was it. I overlooked that local packets do not go trough the
PREROUTING.

thanks for the help
Henry