Iptables Port Redirect Works Locally, Not Outside: A Tech Support Solution

Iptables Port Redirect: A Local Solution, Not External

Iptables is a powerful and flexible firewall tool that is commonly used in Linux systems. One of its many features is the ability to redirect incoming traffic from one port to another. This can be useful in situations where you want to allow access to a service on a non-standard port, but don't want to expose that port to the outside world.

The Problem: Accessing a Service Outside the Local Network

Let's say you have a server that is listening on port 23006, and you want to access that service from the internet using port 443. This is a common scenario, as port 443 is the standard port for HTTPS traffic, and is therefore unlikely to be blocked by most firewalls.

One way to accomplish this is to use iptables to redirect incoming traffic on port 443 to port 23006. This can be done with the following command:

$ sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 23006

This will redirect all incoming traffic on port 443 to port 23006, allowing you to access the service from the internet.

The Catch: It Only Works Locally

However, there is a catch: this solution will only work if you are accessing the server from the local network. If you try to access the server from the internet, the traffic will be blocked by the firewall on the server's external interface.

This is because the iptables rule we created only affects traffic that is incoming to the server's internal interface. Traffic that is incoming to the server's external interface is not affected by this rule, and will be blocked by the firewall.

The Solution: Setting Up a Reverse Proxy

To allow access to the service from the internet, you will need to set up a reverse proxy on the server's external interface. This can be done using a tool like Nginx or Apache. The reverse proxy will listen on port 443, and forward incoming traffic to the server's internal interface on port 23006.

Here is an example of how to set up a reverse proxy using Nginx:

# Install Nginx
$ sudo apt-get install nginx

# Create a new Nginx configuration file
$ sudo nano /etc/nginx/sites-available/redirect

# Add the following configuration to the file
server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;

    location / {
        proxy_pass http://localhost:23006;
    }
}

# Enable the new configuration
$ sudo ln -s /etc/nginx/sites-available/redirect /etc/nginx/sites-enabled/

# Restart Nginx
$ sudo service nginx restart

This configuration will listen on port 443, and forward all incoming traffic to the server's internal interface on port 23006.

Iptables is a powerful and flexible firewall tool, but it has its limitations. In particular, it can only redirect incoming traffic on the local network. To allow access to a service from the internet, you will need to set up a reverse proxy on the server's external interface.

References

• Iptables: https://linux.die.net/man/8/iptables
• Nginx: https://nginx.org/
• Apache: https://httpd.apache.org/