DNAT to 127 fails

[Jörg Harmuth]

Jan Engelhardt schrieb:
> Hi,
> 
> 
> Connection from anywhere-on-the-internet (dsl0) to alphagate:80 only does not 
> work when --to-dest is 127.0.0.1. It works with 192.168.44.1.
> (It's not a bridge problem, that for sure!)
> Why? Some routing problem?
> 
> 
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest 127.0.0.1:8000

"-j DNAT" is not intended to DNAT to localhost. The REDIRECT target is
for this. From "man iptables":

REDIRECT
       This  target  is  only  valid  in the nat table, in the
       PREROUTING and OUTPUT chains, and user-defined chains
       which are only called from those chains.  It redirects
       the packet to the machine itself  by  changing  the
       destination  IP  to  the  primary  address of the incoming
       interface (locally-generated packets are mapped to the 127.0.0.1
       address).  It takes one option:

       --to-ports port[-port]
              This specifies a destination port or range of ports to
              use: without this,  the  destination  port is never
              altered.  This is only valid if the rule also specifies
              -p tcp or -p udp.

Have a nice time,

Joerg