iptables redirecting

Murdock1979 · 05-21-2006, 05:17 PM

Hello!

I am trying to redirect by:

iptables -t nat -A PREROUTING -p tcp -dport 80 REDIRECT --to-ports 8080

and

echo 1 > ip_forward

But nothing seems to change. I can still surf the net even though I have no proxy loaded at 8080. tcpdump does not change it output.

any help will be great!

Murdock

win32sux · 05-21-2006, 06:39 PM

Quote:

Originally Posted by Murdock1979

Hello!

I am trying to redirect by:

iptables -t nat -A PREROUTING -p tcp -dport 80 REDIRECT --to-ports 8080

and

echo 1 > ip_forward

But nothing seems to change. I can still surf the net even though I have no proxy loaded at 8080. tcpdump does not change it output.

any help will be great!

Murdock

you have many typos/errors in your syntax... try like this:

Code:

iptables -F -t nat

iptables -X -t nat

iptables -t nat -A PREROUTING -p TCP -i $LAN_IFACE \
--dport 80 -j REDIRECT --to-ports 8080

echo "1" > /proc/sys/net/ipv4/ip_forward

make sure you replace $LAN_IFACE with your actual LAN interface name...

Murdock1979 · 05-22-2006, 01:18 AM

Thanks,

I made the changes and iptables -L displays the rule. However, it still doesn't seem to be making any difference.

Murdock

win32sux · 05-22-2006, 04:13 AM

you're not trying this on the local machine are you??

post this:

Code:

iptables -L -n -v

something's not right... the rule should indeed redirect all outgoing HTTP packets to the firewall... and in fact it does, at least on my boxes...

Murdock1979 · 05-22-2006, 04:27 AM

yes, this is for a local machine.

I'll get you the output later. I am not at the computer right now. However, I tried it both on Knoppix and VectorLinux and both don't seem to work.

I set up tinyproxy at port 8080 and the logs never mention any connections. It only intializes, but that is it.

UPDATE: I revised the iptables to use the OUTPUT chain in nat. Now the tinyproxy establishes a connection. However, the browser hangs and does not load the web page. What do I need to do?
Also, I am behind a NAT router, so do you think that makes a difference?

Thanks,
Murdock

win32sux · 05-22-2006, 06:18 PM

you really should be doing this at your NAT router, not locally... i kinda suspected you were doing this locally, which is why i asked... the rule i posted would only work on the router...

let me know if you get it to work on the local machine, cuz i've never done it like that, but it sounds kinda interesting...

Murdock1979 · 05-22-2006, 06:31 PM

The family that I am setting up the internet filter for has only one computer, so I am trying to combine the proxy with the client. However, setting up rules to reject non-proxy requests on port 80 seems like an impossibility, because they are identical to the proxy's requests.

I think I got it:
in the nat OUTPUT chaing:

Code:

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            OWNER UID match root tcp dpt:http 
REDIRECT   tcp  --  anywhere             anywhere            tcp dpt:http redir ports 8080

Root is the current user that the tinyproxy is set up as and can probably be changed.

Thanks again for all your help,
Murdock