无法获取nf​​tables将端口80重定向到8080

Question

我已尝试设置我的服务器，因此它将端口80的流量重定向到端口8080，但它不起作用。 （我得到＃34;连接被拒绝＆＃34;错误，如果我telnet到端口80，＆＃34;无法连接＆＃34;与firefox。）

我能够使用iptables让它工作，但更喜欢使用nftables。有谁知道问题可能是什么？ （如果它是相关的，服务器在linode.com上运行，内核由linode提供。）

我在/etc/nftables.conf中有以下内容：

#!/usr/sbin/nft -f

flush ruleset

table ip fw {
        chain in {
                type filter hook input priority 0;

                # accept any localhost traffic
                iif lo accept

                # accept traffic originated from us
                ct state established,related accept

                # accept ssh, alternative http
                tcp dport { ssh, http, http-alt } ct state new counter accept

                counter drop
        }
}

table ip nat {
        chain prerouting {
                type nat hook prerouting priority 0;
                tcp dport http redirect to http-alt
        }

        chain postrouting {
                type nat hook postrouting priority 0;
        }
}

Answer 1

您的意思是table inet filter而不是table ip fw吗？

如果是这样，我遇到了类似的问题。将ip nat prerouting优先级更改为-101使其正常工作，但我不确定原因。它可能与NF_IP_PRI_NAT_DST (-100): destination NAT的默认优先级有关。似乎唯一有效的范围是-101到-200。

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
   chain input {
      type filter hook input priority 0;
      counter

      # accept any localhost traffic
      iif lo accept

      # accept traffic originated from us
      ct state {established,related} accept

      # activate the following line to accept common local services
      tcp dport { 22, 80, 443, 9443 } ct state new accept

      # accept neighbour discovery otherwise IPv6 connectivity breaks.
      ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert } accept

      # count and drop any other traffic
      counter drop
   }
}

table ip nat {

   chain input {
      type nat hook input priority 0;
      counter
   }

   chain prerouting {
      type nat hook prerouting priority -101;
      counter
      tcp dport 443 counter redirect to 9443
   }

   chain postrouting {
      type nat hook postrouting priority 0;
      counter
   }
}

counter规则可以轻松查看链条是否被处理;计数器值可以通过nft list ruleset看到。

Answer 2

如果仅在本地主机上路由，请尝试使用

table ip nat {
   chain output {
      type nat hook output priority 0;
      tcp dport http redirect to http-alt
   }
}

几年前，我读了iptables的文章，说环路设备上的数据包不经过预路由链，而是经过输出链。那是我的问题。