Port redirection not working

Port redirection not working

[Gustavo Narea]

[-- Attachment #1: Type: text/plain, Size: 516 bytes --]

Hello, everyone.

I'm new to netfilter and I'm trying to set a port redirection from port 80 to 
port 8080.

I'm using this line in the attached file:
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

But there's something wrong with it, and I don't know what.

When I run `iptables-restore < /etc/iptables.config', I get this error:
iptables-restore: line 7 failed

I'm using Debian Etch.

Thanks in advance!
-- 
Gustavo Narea.
http://gustavonarea.net/

Get GNU/Linux! http://www.getgnulinux.org/

[-- Attachment #2: iptables.config --]
[-- Type: text/plain, Size: 654 bytes --]

*filter
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A FORWARD -j REJECT --reject-with icmp-port-unreachable
COMMIT

Re: Port redirection not working

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 739 bytes --]

Hi,

Le jeudi 24 janvier 2008 à 12:43 +0100, Gustavo Narea a écrit :
> Hello, everyone.
> 
> I'm new to netfilter and I'm trying to set a port redirection from port 80 to 
> port 8080.
> 
> I'm using this line in the attached file:
> -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

Miss "-t nat" in the line, you need to specify the table to use.

> 
> But there's something wrong with it, and I don't know what.
> 
> When I run `iptables-restore < /etc/iptables.config', I get this error:
> iptables-restore: line 7 failed
> 
> I'm using Debian Etch.
> 
> Thanks in advance!
-- 
Éric Leblond, eleblond@inl.fr
Téléphone : +33 1 44 89 46 40, Fax : +33 1 44 89 45 01
INL, http://www.inl.fr

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Port redirection not working

[Gustavo Narea]

[-- Attachment #1: Type: text/plain, Size: 786 bytes --]

Hello, Eric.

On Thursday 24 January 2008 14:49:54 Eric Leblond wrote:
> > I'm using this line in the attached file:
> > -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
>
> Miss "-t nat" in the line, you need to specify the table to use.

I've changed that line as you suggested, but now I get this error when running 
`iptables-restore < /etc/iptables.config':

==========
iptables-restore v1.3.6: Line 7 seems to have a -t table option.

Error occurred at line: 7
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
==========

It now reads:
-A PREROUTING -t nat -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

Thanks!
-- 
Gustavo Narea.
http://gustavonarea.net/

Get GNU/Linux! http://www.getgnulinux.org/

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Port redirection not working

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

Hi,

Le jeudi 24 janvier 2008 à 16:04 +0100, Gustavo Narea a écrit :
> Hello, Eric.
> 
> On Thursday 24 January 2008 14:49:54 Eric Leblond wrote:
> > > I'm using this line in the attached file:
> > > -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
> >
> > Miss "-t nat" in the line, you need to specify the table to use.
> 
> I've changed that line as you suggested, but now I get this error when running 
> `iptables-restore < /etc/iptables.config':

Hmm sorry, I miss the iptables-restore way to add the rules.

iptables-restore format is not done to be hand edited (although this is
possible).

In fact, best thing to do is to :
      * restore a working file
      * add the NAT rules : iptables -t nat A PREROUTING -p tcp -m tcp
        --dport 80 -j REDIRECT --to-ports 8080
      * iptables-save>/etc/iptables.config

Your error was to add the REDIRECT rules in the filter table.
> 
> ==========
> iptables-restore v1.3.6: Line 7 seems to have a -t table option.
> 
> Error occurred at line: 7
> Try `iptables-restore -h' or 'iptables-restore --help' for more information.
> ==========
> 
> It now reads:
> -A PREROUTING -t nat -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
> 
> Thanks!

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Port redirection not working

[Gustavo Narea]

[-- Attachment #1: Type: text/plain, Size: 1552 bytes --]

Eric, thank you very much for your help! It's now working!

Cheers.

On Thursday 24 January 2008 16:32:45 Eric Leblond wrote:
> Hi,
>
> Le jeudi 24 janvier 2008 à 16:04 +0100, Gustavo Narea a écrit :
> > Hello, Eric.
> >
> > On Thursday 24 January 2008 14:49:54 Eric Leblond wrote:
> > > > I'm using this line in the attached file:
> > > > -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
> > >
> > > Miss "-t nat" in the line, you need to specify the table to use.
> >
> > I've changed that line as you suggested, but now I get this error when
> > running `iptables-restore < /etc/iptables.config':
>
> Hmm sorry, I miss the iptables-restore way to add the rules.
>
> iptables-restore format is not done to be hand edited (although this is
> possible).
>
> In fact, best thing to do is to :
>       * restore a working file
>       * add the NAT rules : iptables -t nat A PREROUTING -p tcp -m tcp
>         --dport 80 -j REDIRECT --to-ports 8080
>       * iptables-save>/etc/iptables.config
>
> Your error was to add the REDIRECT rules in the filter table.
>
> > ==========
> > iptables-restore v1.3.6: Line 7 seems to have a -t table option.
> >
> > Error occurred at line: 7
> > Try `iptables-restore -h' or 'iptables-restore --help' for more
> > information. ==========
> >
> > It now reads:
> > -A PREROUTING -t nat -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
> >
> > Thanks!



-- 
Gustavo Narea.
http://gustavonarea.net/

Get GNU/Linux! http://www.getgnulinux.org/

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]