4

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet.

On purpose of testing, when opening the firewall for port 8080, accessing IPv6:8080 address works fine (no permanent solution, at the end the port have to be closed)

So we need a kind of port forwarding like offered by ip6tables TPROXY to another local port as proposed here. But the following is not working:

ip6tables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j TPROXY --on-port 8080

It simply don't return any data. (Even when removing all other rules from ip6tables, only this one is available) When looking to the packages with "ip6tables -t mangle -vL" I see the number of packes grow on the line of the TPROXY rule. When opening the "conntrack -E" I see only one line appearing flagged with [DESTROY]. When looking to "netstat -anp --tcp" I don't see the new port 80, only the applications port 8080.

Same problem, if temporary reconfiguring the application to port 80 and use "-j TPROXY --on-port 80" or "-j TPROXY --on-port 0", so basically testing a port forwarding to the same port - no success. Same problem, if using the advanced routing by header marking with:

ip6tables -t mangle -R PREROUTING 1 -i eth0 -p tcp --dport 80 -j TPROXY --on-port 8080 --tproxy-mark 0x2/0x3
ip -6 rule add fwmark 2 lookup 6
ip -6 route add local ::/0 dev eth0 table 6

I've loaded "modprobe xt_TPROXY" and "echo 1 > /proc/sys/net/ipv6/conf/all/forwarding"

Any idea why this is not working on Debian Wheezy with ip6tables v1.4.14 at all? Did I forgot some very basic configuration steps (these are my first steps with ip6tables and IPv6 at all)?

Thanks Achim

PS: Some other possible solutions would be to use IPv6 DNAT/SNAT with Ubuntu 12.04 LTS, like proposed here or use NAT66, like proposed here, but both technologies don't looks confidential, I can't found working examples either...

Community
  • 1
Achim
  • 283
  • 3
  • 13
  • You're doing it wrong. This is IPv6, you shouldn't even be thinking about NAT or port forwarding or any of that old style garbage. Just run the server on port 80 and open the firewall for it. – Michael Hampton Apr 25 '13 at 02:09
  • 1
    I fully understand your argument and in general you are right, but.... I have some small old servers which simply can't migrate to IPv6, too much effort (I've tried this now the last weeks and gave up). So I need to connect them with an SSH remote tunnel to a central router. There will be a new port opened for each server and that's the reason why I need Port forwarding. e.g. Standard port 80 of IP-alias 1 to port 8001, and port 80 of IP-alias 2 to port 8002... – Achim May 10 '13 at 23:57
  • In that case you need NAT64, not "NAT66". – Michael Hampton May 10 '13 at 23:59

0 Answers0