<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 06/04/2014 08:32 AM, Phil Whineray
wrote:<br>
</div>
<blockquote type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 18px;"
lang="x-western">
<pre wrap="">Hi Silvio
On Wed, Jun 04, 2014 at 02:18:43AM +0200, Silvio Bierman wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">I use firehol to forward all HTTP(S) traffic from ports 80/443 to
8080/8443 on the same machine. I use config lines like
dnat to xxx.xxx.xxx.xxx:8080 proto tcp dport 80
dnat to xxx.xxx.xxx.xxx:8443 proto tcp dport 443
to achieve this where xxx.xxx.xxx.xxx is the IP address of the box
itself. This means that firehol is running on the same host as the
webserver.
Now my problem is that when the webserver does a HTTP request to
itself (for example by following a URL relative to that of an
incoming request) the request targets port 80 but does not get
forwarded to 8080 because it comes from the local machine. This
forces me to do extra URL manipulation to explicitly target port
8080.
</pre>
</blockquote>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">How can I get around this and have all traffic forwarded?
</pre>
</blockquote>
<pre wrap="">The firehol dnat helper won't do this. It doesn't set up rules on the
OUTPUT chain in the NAT table, which is what I think you need here, but
is not something a firewall would normally be called on to do.
You can use the iptables helper to add extra rules after the dnat helpers
to do what you want. This does what you describe, where $ip should be
replaced with xxx.xxx.xxx.xxx from your example:
# Redirect $ip:80 to port 8080, when generated on local machine
iptables -t nat -A OUTPUT -d $ip -p tcp --dport 80 -j REDIRECT --to-port 8080
Add this too, if you want <a class="moz-txt-link-freetext" href="http://localhost:80/">http://localhost:80/</a> to also redirect:
# Redirect port 80 to port 8080, when using loopback interface
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8080
Hope that helps,
Phil
</pre>
</div>
</blockquote>
<br>
Thank you Phil,<br>
<br>
This works great, thank you.<br>
<br>
I have entered these commands manually logged in as root. Is this
something I could do from the firehol.conf line? If so, would these
redirects also be removed from iptables if I stop the firehol
service?<br>
<br>
Thanks again.<br>
<br>
Cheers,<br>
<br>
Silvio<br>
<br>
</body>
</html>