Port redirection not working with IP tables

user_1451573 0
Viewed 941

We are working on to use istio ingress gateway with NLB and by default ingress gateway runs on nodeport (range 30000-32767) that means higher ports.

But we have existing security group rules that are configured to port 80-443 and we have lots of rules with many source IPs and we almost hit to security group rules limit. So we can't have any more rules for 31380 and 31390 port. We need a way to use same security groups with ingress gateway and NLB as well.

As a solution we are planning to use linux iptables for port re-direction that will redirect what ever comes to port 80 and 443 via minion NLB will route to 31380 and 31390 (ingress gateway nodeports)

But i'm struggling to do this and port redirection not happening properly and i can't see any packet hit ingress gateway via NLB.

I have configured following iptables rules in my worker nodes,

iptables -A INPUT -p tcp -m tcp --dport 31380 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 31380 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:31380

But when i'm trying to reach port 80 of this minion (ingress gateway also in same node) from another instance i'm getting following error,

$ curl -v 10.1.29.77

* Rebuilt URL to: 10.1.29.77/
*   Trying 10.1.29.77...
* TCP_NODELAY set
* connect to 10.1.29.77 port 80 failed: Connection refused
* Failed to connect to 10.1.29.77 port 80: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 10.1.29.77 port 80: Connection refused

But i could able to access node port from same instance,

$ curl -v 10.1.29.77:31380
* Rebuilt URL to: 10.1.29.77:31380/
*   Trying 10.1.29.77...
* TCP_NODELAY set
* Connected to 10.1.29.77 (10.1.29.77) port 31380 (#0)
> GET / HTTP/1.1
> Host: 10.1.29.77:31380
> User-Agent: curl/7.61.1
> Accept: */*
> 
< HTTP/1.1 404 Not Found
< date: Tue, 30 Jun 2020 12:52:17 GMT
< server: istio-envoy
< content-length: 0

Do you guys have any idea on this?

istio iptables tcp
1 Answers

You are using the OUTPUT chain. This is the chain for packages FROM from inside your server to the network, not for incoming packages.

To redirect from port 80 to port 31380, you need to use PREROUTING chain. This chain is used for DNAT mainly. Try this :

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 127.0.0.1:31380

To learn more about tables and chains in iptables, check this link

user_87541710
Related