[Day 9] 3. Port forwarding using PREROUTING chain

Setup Details

• Machine: Debian (
  Copy

  192.168.80.128

  )
• Service: Apache installed (default port: 80)

Objective

Use PREROUTING in the NAT table to perform dynamic NAT (port forwarding). Redirect traffic from port

8000

80

Steps

1. Run the PREROUTING Command
   Execute the following command to configure port forwarding:

   bashCopy
   sudo iptables -t nat -A PREROUTING -p tcp --dport 8000 -j REDIRECT --to-port 80
   

   Explanation:

   • Copy

     -t nat

     : Use the NAT table.
   • Copy

     -A PREROUTING

     : Append the rule to the PREROUTING chain.
   • Copy

     -p tcp

     : Match TCP packets.
   • Copy

     --dport 8000

     : Match packets destined for port 8000.
   • Copy

     -j REDIRECT

     : Redirect the packet.
   • Copy

     --to-port 80

     : Redirect to port 80 (where Apache is listening).

2. Verify the Rule
   Check if the rule has been added successfully:

   bashCopy
   sudo iptables -t nat -L -n -v
   

   This will display the NAT table rules, including the newly added PREROUTING rule.

Test the Setup

1. Open a browser or use a tool like

   Copy

   curl

   to test:

   bashCopy
   curl http://192.168.80.128:8000
   

   If configured correctly, this will serve content from Apache (running on port 80).

2. Traffic Behavior

   • Any traffic sent to port
     Copy

     8000

     is automatically forwarded to port
     Copy

     80

     .

Conclusion

This simple rule dynamically forwards traffic from one port to another using iptables' NAT table and the PREROUTING chain.