debian iptables squid - redirect port 80 to port 8080 on another machine

nickleus · 08-15-2006, 08:15 AM

i have a linux (rh7) machine (webMachine, ip: 192.168.0.5) running a web server on port 8080.
i have another linux (debian) machine on the same network (firewallMachine, two interfaces ip: 10.0.0.40 [out to inet], ip: 192.168.0.2 [connected to internal network]).

on firewallMachine i have also installed squid, to reverse proxy for webMachine, i.e. hide all external ip addresses from webMachine, so it thinks only 1 ip address is communicating with it.

squid is configured to listen to port 80 and then redirect everything to webMachine on port 8080.
here is some of my relevant squid.conf configuration:

Code:

http_port 80
acl our_networks src 192.168.0.0/24 10.0.0.0/24
http_access allow our_networks
http_access allow localhost
httpd_accel_host 192.168.0.5
httpd_accel_port 8080
httpd_accel_single_host on
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

(i'm not sure if all of these should be enabled, need help)

and my relevant iptables lines in firewall.sh:

Code:

$IPT -A FORWARD -p tcp -i $INET_IFACE --destination-port 80 -j ACCEPT
$IPT -t nat -A PREROUTING -i $INET_FACE -p tcp --dport 80 -j REDIRECT --to-port 8080

i can't seem to reach webMachine from the internet (everything is set up correctly on my router, that much i do know).

bulliver · 08-17-2006, 12:59 AM

My router passes web/mail requests to a DMZ machine, just like what you are looking for I think. My relevant rules look like this:

Code:

$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 80 -j DNAT --to 192.168.0.11:80
$IPTABLES -A FORWARD -p tcp -i eth0 -o eth1 -d 192.168.0.11 --dport 80 -m state --state NEW -j ACCEPT

The only difference is that both of my machines are using port 80. Have a look at using DNAT rather than REDIRECT.

HTH