Reinhard Max <[email protected]> writes: >Hi, > >On Wed, 10 Feb 2010 at 07:18, Tomasz Sterna wrote: > >> iptables -t nat -A PREROUTING \ >> -p tcp --dport 80 -j REDIRECT --to-ports 5222 > >this works if jabberd listens on the wildcard address or on the >primary IP address of the incoming interface. > >If it explicitly binds to a secondary address ($XMPPADDR), the DNAT >target is needed, because it allows to specify the destination IP >address for the redirection: > >iptables -t nat -A PREROUTING \ > -d $XMPPADDR -p tcp -m tcp --dport 80 \ > -j DNAT --to-destination $XMPPADDR:5222 > > >cu > Reinhard
All this is very nice but ip6tables cannot do this for ipv6 ports so there is still a need to be able to specify this at the application level. ipv6 doesn't need NAT so ip6tables doesn't have the nat table. Also, you can use the linux kernel capabilities to permit the jabberd application to bind to service ports without actually needing root permissions. The cap_net_bind_service capability specifically permits binding ports < 1024. So apply that to your executable file if you are using a recent kernel (>= 2.6.24 I think - the current Ubuntu Server can manage it) and install the libcap2 package you do: setcap 'cap_net_bind_service=+ep' executablefilename -- Pat Thoyts http://www.patthoyts.tk/ PGP fingerprint 2C 6E 98 07 2C 59 C8 97 10 CE 11 E6 04 E0 B9 DD -- To unsubscribe send a mail to [email protected]
