redirect 127.0.0.1:25 -> 127.0.0.1:2000

Hi folks.

I'm using a nat PREROUTING rule to forward all connections
from port 25 
to port 2000.  This works fine for all addresses except for
localhost.

the rule i'm using is: "-A PREROUTING -p tcp -m tcp
--dport 25 -j 
REDIRECT --to-ports 2000" (CentOS4, kernel 2.6.9-55,
iptables-1.2.11)

For example, on my machine: foobar.example.com

If i telnet from any machine other than foobar.example.com
to 
foobar.example.com:25, the connection is redirected 
properly to 
foobar.example.com:2000. 

However, if i telnet from foobar.example.com to
localhost:25, i get a 
connection refused. 

Telnetting to from foobar.example.com to localhost:2000
works fine (as 
expected)

Telnetting from foobar.example.com to foobar.example.com:25
also does 
not work.

I know that you can't do prerouting from localhost ->
some.other.host 
(or vice versa), but i thought localhost->localhost would
work.

Am i screwing up the rule? Should I add another rule?  Or am
i just SOL.

Thanks.

...alex...

In looking through the mail archive, i see this post:


Alex Tang wrote:
> Hi folks.
>
> I'm using a nat PREROUTING rule to forward all
connections from port 
> 25 to port 2000.  This works fine for all addresses
except for localhost.
>
> the rule i'm using is: "-A PREROUTING -p tcp -m
tcp --dport 25 -j 
> REDIRECT --to-ports 2000" (CentOS4, kernel
2.6.9-55, iptables-1.2.11)
>
> For example, on my machine: foobar.example.com
>
> If i telnet from any machine other than
foobar.example.com to 
> foobar.example.com:25, the connection is redirected 
properly to 
> foobar.example.com:2000.
> However, if i telnet from foobar.example.com to
localhost:25, i get a 
> connection refused.
> Telnetting to from foobar.example.com to localhost:2000
works fine (as 
> expected)
>
> Telnetting from foobar.example.com to
foobar.example.com:25 also does 
> not work.
>
> I know that you can't do prerouting from localhost
-> some.other.host 
> (or vice versa), but i thought localhost->localhost
would work.
>
> Am i screwing up the rule? Should I add another rule? 
Or am i just SOL.
>
> Thanks.
>
> ...alex...
>
>

ARGH.  Sorry about my premature previous post...lemme try
this again...

Hi again,

In looking through the mail archive, i see this thread,

http://lists.netfilter.org/pipermail/net
filter/2004-November/057098.html

which answered my question. 

I verified that the kernel had IP_NF_NAT_LOCAL set to y, and
i see that 
I was missing the "iptables -t nat -A OUTUPT"
line.  Everything works 
now. Whoohoo!

Thanks.

...alex...


Alex Tang wrote:
> Hi folks.
>
> I'm using a nat PREROUTING rule to forward all
connections from port 
> 25 to port 2000.  This works fine for all addresses
except for localhost.
>
> the rule i'm using is: "-A PREROUTING -p tcp -m
tcp --dport 25 -j 
> REDIRECT --to-ports 2000" (CentOS4, kernel
2.6.9-55, iptables-1.2.11)
>
> For example, on my machine: foobar.example.com
>
> If i telnet from any machine other than
foobar.example.com to 
> foobar.example.com:25, the connection is redirected 
properly to 
> foobar.example.com:2000.
> However, if i telnet from foobar.example.com to
localhost:25, i get a 
> connection refused.
> Telnetting to from foobar.example.com to localhost:2000
works fine (as 
> expected)
>
> Telnetting from foobar.example.com to
foobar.example.com:25 also does 
> not work.
>
> I know that you can't do prerouting from localhost
-> some.other.host 
> (or vice versa), but i thought localhost->localhost
would work.
>
> Am i screwing up the rule? Should I add another rule? 
Or am i just SOL.
>
> Thanks.
>
> ...alex...
>
>

On May 18 2007 15:46, Alex Tang wrote:
>
> which answered my question. 
> I verified that the kernel had IP_NF_NAT_LOCAL set to
y, and i see that I was
> missing the "iptables -t nat -A OUTUPT" line.
 Everything works now. Whoohoo!

IP_NF_NAT_LOCAL is removed in later kernels, so don't even
think
about starting to use it.

You will be perfectly fine when not having that enabled, -A
OUTPUT
does it all.


	Jan
--