The DNAT operation happens firstly so the INPUT rule needs to refer to port 22 since the address/port mangle has already occurred. Secondly, instead of DNAT, you could have used the redirect jump instead. -----Original Message----- From: Richard Plana [mailto:rplana@xxxxxxxxxx] Sent: Tuesday, July 29, 2003 12:07 PM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Adding listening ports Hi, Because of (overly?) strict security policies at our company, one can only make TCP connections to ports 80 and 443. I was wondering if netfilter could be used to redirect packets destined for port 443 to the listening sshd daemon on port 22 on an external machine. I tried "iptables -I RH-Lokkit-0-50-INPUT 5 -p tcp -m tcp --dport 443 --syn -j ACCEPT" (I'm using RedHat's default config) and "iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 127.0.0.1:22" to do the actual routing, but that didn't seem to work: $ ssh -p 443 localhost ssh: connect to host localhost port 443: Connection refused Suggestions would be appreciated. -- *Richard Neal Plana, B.Sc., CCNA* Lead Software Engineer Zi Corp.
