Re: redirect/dnat to localhost address in prerouting chain?

I think what’s happening with |redirect| is that the NAT doesn’t map the 
traffic to |127.0.0.1|, but instead rewrites the destination to the IP 
address of the ingress interface. That means the service must be 
listening on the wildcard address (or specifically on that interface 
address) in order to accept the connection. If it only listens on 
|127.0.0.1|, the connection will fail because the packets never get 
translated to the loopback address.

But please correct me if I'm wrong.


Swifty

2025. 09. 25. 18:52 keltezéssel, Ian Pilcher írta:
> I have a multi-homed host that (among a lot of other things) routes
> traffic between the different subnets in my home network.  On that host
> I have a couple of *redirect* rules in a prerouting chain:
>
> table ip nat {
>
>   chain prerouting {
>     type nat hook prerouting priority dstnat + 20
>     policy accept
>
>     # HTTPS connections to old switches are redirected to stunnel
>     ip daddr { ... } tcp dport 443 redirect to :8084
>
>     # HTTP connections to the management network are redirected to an
>     # Apache virtual host that will send a redirect to the HTTPS version
>     ip daddr .../24 tcp dport 80 redirect to :8089
>   }
> }
>
> In order to make this work, I currently have both stunnel and Apache
> listening on the IPv4 wildcard address, which I don't like. There's no
> reason that stunnel or Apache (on that port) should ever receive traffic
> directly from another host.
>
> Unfortunately, I haven't been able to make things work when stunnel or
> Apache is configured to only listen on 127.0.0.1.  The redirect rules
> shown above result in a "connection refused" error.  I've also tried
> changing the rules from redirects to dnats, e.g.:
>
>   redirect to :8084 → dnat to 127.0.0.1:8084
>
> This causes connection attempts to time out.
>
> Is there any way to make this work?
>
> TIA!
>