2

I have a server that is running a web application deployed on Tomcat and is sitting in a test network. We're running SuSE 11 sp1 and have some redirection rules for incoming requests. For example we don't bind port 80 in Tomcat's server.xml file, instead we listen on port 9600 and have a configuration line in SuSEfirewall2 to redirect port 80 to 9640. This is because Tomcat doesn't run as root and can't open up port 80.

My web application needs to be able to make requests to port 80 since that is the port it will be using when deployed. What rule can I add so that local requests get redirected by iptables?

I tried looking at this question: How do I redirect one port to another on a local computer using iptables? but suggestions there didn't seem to help me.

I tried running tcpdump on eth0 and then connecting to my local IP address (not 127.0.0.1, but the actual address) but I didn't see any activity. I did see activity if I connected from an external machine. Then I ran tcmpdump on lo, again tried to connect and this time I saw activity. So this leads me to believe that any requests made to my own IP address locally aren't getting handled by iptables.

Just for reference he's what my NAT table looks like now:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             anywhere            tcp dpt:http redir ports 9640
REDIRECT   tcp  --  anywhere             anywhere            tcp dpt:xfer redir ports 9640
REDIRECT   tcp  --  anywhere             anywhere            tcp dpt:https redir ports 8443

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Community
  • 1
James
  • 21
  • 2

1 Answers1

0

First of all want to say I don't believe that Tomcat acting as unpriveleged users can't bind 80 port. Possible you have unsafficient rights for this user. What about redirection: your table output is incomplete. Can you please provide iptables -nvL -t nat output? I mean here you can have reject rules by interface and your output don't show this. What about requests from local terminal: Just think about that choice about routing depends from routing table and which interface will send packet depends from routing table too. So if your application binds only lo interface you get internal traffic from 'lo' to 'lo'

taho
  • 1