Scenario

A service on your server is running on port 8080, but you now need it to also be reachable on port 8081. The application cannot be restarted and its configuration cannot be changed.

Task

Verify the service is listening on 127.0.0.1:8080. Configure iptables to forward all TCP traffic from port 8081 to port 8080, ensuring this works for both external requests and local connections (localhost). Verify the forwarding works, then save the rules to persist after a reboot using iptables-save

Example

tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      1234/java

PREROUTING (policy ACCEPT)
REDIRECT   tcp  --  0.0.0.0/0   0.0.0.0/0   tcp dpt:8081 redir ports 8080

OUTPUT (policy ACCEPT)
REDIRECT   tcp  --  0.0.0.0/0   127.0.0.1   tcp dpt:8081 redir ports 8080

Step 1: Check if the application is listening on port 8080

ss -tlnp | grep 8080

Look for a line showing the process listening on 127.0.0.1:8080 or 0.0.0.0:8080.

Step 2: Check current iptables NAT rules

sudo iptables -t nat -L -n -v

View the current state of the NAT table before making changes.

Step 3: Test that port 8081 is not yet responding

curl http://localhost:8081

This should fail since nothing is listening on 8081 yet.

Step 4: Add PREROUTING rule for external traffic

sudo iptables -t nat -A PREROUTING -p tcp --dport 8081 -j REDIRECT --to-ports 8080

This redirects external connections to port 8081 to port 8080.

Step 5: Add OUTPUT rule for locally-originated traffic

sudo iptables -t nat -A OUTPUT -p tcp --dport 8081 -d 127.0.0.1 -j REDIRECT --to-ports 8080

This redirects local connections (localhost) to port 8081 to port 8080.

Step 6: Test with netcat to verify the connection

nc -zv localhost 8081

This should show "Connection succeeded".

Step 7: Save iptables rules to persist after reboot

sudo iptables-save | sudo tee /etc/iptables/rules.v4