Redirecting incoming traffic to 127.0.0.1

Redirecting incoming traffic to 127.0.0.1

[Henry Ritzlmayr]

I have a service running on a box wich is only able to bind to 127.0.0.1
(hardcoded and I can´t get the source to change it). Since I want to use
it from any other box the only way to solve that I think is to nat
incoming packets to 127.0.0.1.

IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12 -j DNAT
--to-destination 127.0.0.1

and many others wich I tried don´t work. 

If I understood REDIRECT correctly it only changes to the local IP where
the packet came in (in my situation 172.16.172.12) wich also not solves
the problem. 

any ideas?

Henry

Re: Redirecting incoming traffic to 127.0.0.1

[Negrea Mihai]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Maybe the packets reach your service listening on the localhost but they 
cannot get to the client because it has the source 127.0.0.1

Try SNAT-ing those packets:
iptables -t nat -A POSTROUTING -p tcp -s 127.0.0.1 -j SNAT --to 172.16.172.12

hope I understood the problem

All the best,

- -- 
Negrea Mihai
http://www.negrea.net

On Friday 21 March 2003 16:31, Henry Ritzlmayr wrote:
> I have a service running on a box wich is only able to bind to 127.0.0.1
> (hardcoded and I can´t get the source to change it). Since I want to use
> it from any other box the only way to solve that I think is to nat
> incoming packets to 127.0.0.1.
>
> IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12 -j DNAT
> --to-destination 127.0.0.1
>
> and many others wich I tried don´t work.
>
> If I understood REDIRECT correctly it only changes to the local IP where
> the packet came in (in my situation 172.16.172.12) wich also not solves
> the problem.
>
> any ideas?
>
> Henry

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+eybk8hhhNOp8KlQRAiRpAJ9h3NJ7OLgMhBnPG+ToZ9dAweXAOwCg3R/4
WtZ8kbHYrihBupFC91nPUeg=
=PFnF
-----END PGP SIGNATURE-----

Re: Redirecting incoming traffic to 127.0.0.1

[Henry Ritzlmayr]

I am not sure if I understood your approach - but I tried it and it
doesn´t do the trick. 
What I need is whenever a packet arrives on an external interface it
should be redirected to 127.0.0.1 (localhost). This is needed because a
service is listening only on localhost (not ment to be used on the
network). 

Henry

Am Fre, 2003-03-21 um 15.51 schrieb Negrea Mihai:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Maybe the packets reach your service listening on the localhost but they 
> cannot get to the client because it has the source 127.0.0.1
> 
> Try SNAT-ing those packets:
> iptables -t nat -A POSTROUTING -p tcp -s 127.0.0.1 -j SNAT --to 172.16.172.12
> 
> hope I understood the problem
> 
> All the best,
> 
> - -- 
> Negrea Mihai
> http://www.negrea.net
> 
> On Friday 21 March 2003 16:31, Henry Ritzlmayr wrote:
> > I have a service running on a box wich is only able to bind to 127.0.0.1
> > (hardcoded and I can´t get the source to change it). Since I want to use
> > it from any other box the only way to solve that I think is to nat
> > incoming packets to 127.0.0.1.
> >
> > IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12 -j DNAT
> > --to-destination 127.0.0.1
> >
> > and many others wich I tried don´t work.
> >
> > If I understood REDIRECT correctly it only changes to the local IP where
> > the packet came in (in my situation 172.16.172.12) wich also not solves
> > the problem.
> >
> > any ideas?
> >
> > Henry
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.7 (GNU/Linux)
> 
> iD8DBQE+eybk8hhhNOp8KlQRAiRpAJ9h3NJ7OLgMhBnPG+ToZ9dAweXAOwCg3R/4
> WtZ8kbHYrihBupFC91nPUeg=
> =PFnF
> -----END PGP SIGNATURE-----
> 

Re: Redirecting incoming traffic to 127.0.0.1

[Henry Ritzlmayr]

SNAT ist only valid in the POSTROUTING chain. But even that didn´t do 
the trick. 
Do you know any way to check what really happens with the packet since
tcpdump only shows it before natting? 
If there is no tool/command or anything like that - than it looks like I
found something to refreshen my c/c++ skills.

Henry


Am Fre, 2003-03-21 um 16.09 schrieb David Ruggles:
> I think (if I understand the problem) I would try this:
> 
> iptables -t nat -A PREROUTING -p tcp -d 172.16.172.12 -j
> DNAT --to-destination 127.0.0.1
> iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -j SNAT --to-source
> 127.0.0.1
> 
> Please let me know if this works.
> 
> Thanks,
> David Ruggles
> 
> CCNA MCSE (NT) CNA A+
> Network Engineer, Safe Data, Inc
> 910-285-7200    david@safedatausa.com
> 0100011101101111011001000110110001101111011101100110010101110011011110010110
> 111101110101
> ----- Original Message -----
> From: "Henry Ritzlmayr" <h.ritzlmayr@gmx.at>
> To: "Netfilter Mailing List" <netfilter@lists.netfilter.org>
> Sent: Friday, March 21, 2003 9:31 AM
> Subject: Redirecting incoming traffic to 127.0.0.1
> 
> 
> > I have a service running on a box wich is only able to bind to 127.0.0.1
> > (hardcoded and I can´t get the source to change it). Since I want to use
> > it from any other box the only way to solve that I think is to nat
> > incoming packets to 127.0.0.1.
> >
> > IPTABLES -t nat -A PREROUTING -p tcp -d 172.16.172.12 -j DNAT
> > --to-destination 127.0.0.1
> >
> > and many others wich I tried don´t work.
> >
> > If I understood REDIRECT correctly it only changes to the local IP where
> > the packet came in (in my situation 172.16.172.12) wich also not solves
> > the problem.
> >
> > any ideas?
> >
> > Henry
> >
> >
> 

RE: Redirecting incoming traffic to 127.0.0.1

[Daniel Chemko]

To monitor what is going on you could always mark the packets and log them going through the system, no?

I thought you could always drop the 'lo' interface and bind 127.0.0.1 to another inter face, but apparently that gives me an error every time I try to connect to it. I use 2.4.18 kernel and iproute2. You could try that, but I am not sure that it will do any good.

Is this a constraint in the kernel for security, or just something wonky with my setup?



-----Original Message-----
From: Henry Ritzlmayr [mailto:h.ritzlmayr@gmx.at] 
Sent: Friday, March 21, 2003 8:58 AM
To: Netfilter Mailing List
Subject: Re: Redirecting incoming traffic to 127.0.0.1

SNAT ist only valid in the POSTROUTING chain. But even that didn´t do 
the trick. 
Do you know any way to check what really happens with the packet since
tcpdump only shows it before natting? 
If there is no tool/command or anything like that - than it looks like I