Tomcat – Fix Port Redirect 443 to 8443 Not Working

iptableslinuxnetworkingport-forwardingtomcat

im using ubuntu headless server 18.04 on a dedicated host server.
The hoster has external firewall, where i opened the ports 8443,443 (tcp).
On my ubuntu server im using iptables, where i redirected the port 443 to 8443 with the table nat.

iptables -A PREROUTING -t nat -p tcp --dport 443 -j REDIRECT --to-ports 8443

also i opened in inbound & outbound the ports 443& 8443.

i can still access the tomcat instance with example.com:8443 and have no problem but example.com doesnt response.
looking in iptables i dont see any drop packet. On my tomcat istance i doesnt change the server.xml. The Connector listen 8443.
I dont know, where is the issue ?
I hope some experts can help me to fix the problem.

kind regards

blackbeard

Best Answer

What you really need here is a reverse proxy (such as Nginx) that can do SSL termination for you on port 443 and then pass the request to Tomcat on port 8443.

SSL/TLS is complex, and in my view, relying on IPTABLES to handle the SSL handshake and get your request to the Tomcat application is not a good idea.

If you really need to use IPTABLES, connect to the service with openssl and find out exactly what is happening. Report output here and more help might be available.

openssl s_client -connect www.example.com:443

The issue may also be that you're using the nat table. My understanding is that rules for this table are only applied if the requests are being routed through the server, as opposed to be routed to a different port on the same ip address.

A reverse proxy would remove a lot of this complexity, and give you lots more functionality (eg rate limiting, access control etc etc) to boot.

Related Topic