Re: Redirect incoming connection on a given interface to the loopback interface

Le 05/04/2023 à 08꞉43, Tuomo Soini a écrit :
> REDIRECT does not change destination ip - you
> need to change your software to listen all ip addresses for redirect to
> work. DNAT is the way if you need to change destination ip.
I can't change the software unfortunately.
I tried this rule:

DNAT:INFO:mqtt          loc     $FW::1883               tcp 1883    
-       &enp4s0

But that's basically a REDIRECT and does not work for a service bound to 
127.0.0.1
So I tried this rule:

DNAT:INFO:mqtt          loc     $FW:127.0.0.1:1883 tcp     1883    
-       &enp4s0

And it gives me the "martian sources" error that I already mentioned
I also tried this rule:

DNAT:INFO:mqtt          loc     lo::1883               tcp 1883    
-       &enp4s0

But it gives me "unknown zone", so I defined it in the "zones" file like 
this:
lo              loopback

But this got me these messages:
WARNING: *** lo is an EMPTY ZONE *** /etc/shorewall/hosts (EOF)
ERROR: Rules may not override a NONE policy /etc/shorewall/rules

Fair enough, I went into interfaces and added this:
lo              lo                      loopback

No more warning, but still the same error that a rule cannot override a 
NONE policy.
And I'm back to square one where I cannot find which NONE policy applies 
because I have no such thing in the policy file.