在ip6tables中重定向端口

Question

在ip6tables中重定向端口

ipv6iptables

18

我该如何使用ip6tables将一个端口重定向到另一个本地端口？例如：像这样： ip6tables -t nat -A PREROUTING -j REDIRECT -p tcp --dport 443 --to-ports 8443

- Changming Sun

2个回答

6

ip6tables 不支持 REDIRECT。(通常人们在NAT环境中使用此功能，而IPv6通常不支持NAT。)

如果你只需要像普通用户一样绑定到低端口，为什么不尝试此答案中描述的解决方法呢？当然，在Tomcat的情况下，这意味着任何Java进程都具有该功能。

- mpontillo

11

显然，ip6tables v1.4.18和Linux内核v3.8支持REDIRECT功能：https://sector7g.be/posts/ipv6-nat-pre-routing-with-iptables - TRS-80

iptables 不使用 NAT，但是支持它。 - maxadamo

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- Adrien Clerc · Accepted Answer

这是一个老问题，但由于我需要做同样的事情...这就是我找到的：

TPROXY

This target is only valid in the mangle table, in the PREROUTING chain and user-defined chains which are only called from this chain. It redirects the packet to a local socket without changing the packet header in any way. It can also change the mark value which can then be used in advanced routing rules. It takes three options:
--on-port port
    This specifies a destination port to use. It is a required option, 0 means the new destination port is the same as the original. This is only valid if the rule also specifies -p tcp or -p udp. 
--on-ip address
    This specifies a destination address to use. By default the address is the IP address of the incoming interface. This is only valid if the rule also specifies -p tcp or -p udp. 
--tproxy-mark value[/mask]
    Marks packets with the given value/mask. The fwmark value set here can be used by advanced routing. (Required for transparent proxying to work: otherwise these packets will get forwarded, which is probably not what you want.)

这仅适用于 ip6tables。所以我猜这是正确的：

ip6tables -t mangle -A PREROUTING -p tcp --dport 443 -j TPROXY --on-port 8443

然而，我还没有尝试过它。