iptables:redirect ports except for packets destined for fierwall(upto 256 ip) itself

mmshekiba · 02-01-2006, 04:25 AM

Hi,
I want to redirect packets with dport 80,81,8181,8888 to 8081 except for packets destined for firewall itself.because there is a web server running on Firewall on port 80 for configuring Firewall.
firewall has 2 NICs:
eth0: local network(s)
eth1: internet
firewall's eth0 can have up to 256 ip address with ip aliasing.
for example eth0 has ips:
192.168.168.201
192.168.1.150
192.168.10.66
192.168.16.32
192.168.17.50
192.168.13.3
how can I edit below rules to do what I want?

iptables -A PREROUTING -s 192.168.168.0/255.255.255.0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8081
iptables -A PREROUTING -s 192.168.168.0/255.255.255.0 -p tcp -m tcp --dport 81 -j REDIRECT --to-ports 8081
iptables -A PREROUTING -s 192.168.168.0/255.255.255.0 -p tcp -m tcp --dport 8180 -j REDIRECT --to-ports 8081
iptables -A PREROUTING -s 192.168.168.0/255.255.255.0 -p tcp -m tcp --dport 8181 -j REDIRECT --to-ports 8081
iptables -A PREROUTING -s 192.168.168.0/255.255.255.0 -p tcp -m tcp --dport 8888 -j REDIRECT --to-ports 8081

TNX

win32sux · 02-02-2006, 12:08 PM

you could do it like this:

Code:

iptables -A PREROUTING -p TCP -s 192.168.168.0/255.255.255.0 \
-d ! 192.168.0.0/255.255.0.0 --dport 80 -j REDIRECT --to-ports 8081

or to achieve the same with less typing:

Code:

iptables -A PREROUTING -p TCP -s 192.168.168.0/24 \
-d ! 192.168.0.0/16 --dport 80 -j REDIRECT --to-ports 8081