How add loopback rules on iptables?

Tony Montana

I think, for JIRA need loopback redirect fron 443 port to 8443 port

Our iptables config:

# Generated by iptables-save v1.4.21 on Mon Jan 16 15:05:07 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3552794:2931603166]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Mon Jan 16 15:05:07 2017
# Generated by iptables-save v1.4.21 on Mon Jan 16 15:05:07 2017
*nat
:PREROUTING ACCEPT [61:8946]
:INPUT ACCEPT [78:4096]
:OUTPUT ACCEPT [26:1751]
:POSTROUTING ACCEPT [34:2231]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
-A OUTPUT -o lo -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
-A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
-A OUTPUT -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
COMMIT
# Completed on Mon Jan 16 15:05:07 2017

 

I think, need add:

A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443

Right?

Volodymyr Krupach @BrizoIT

First google gives me this (which looks fine for me):

iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-ports 8443

I never did such routing so please update us if it works for you.

BTW: why do not you do it more common way by up-fronting JIRA/Confluence with nginx or apache. This looks more natural for me and works without any problem. Plus having SSLs under Tomcat looks kind weird for me.