Thanks, Florin and Robert, for your suggestions.
I'm still stumped, though.
This rule looks to be the REDIRECT rule that Robert suggests. Unfortunately, as I have it written here, it fail instantly -- telnetting to port 80 causes an instant error. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to- ports 127.0.0.1:8080
This gets packets in, but no reply: iptables -t nat -A PREROUTING -p tcp -d 64.61.61.112 --dport 80 -j DNAT --to-destination 127.0.0.1:8080
Florin, I did try running tcpdump before -- good to hear this was a sound way to debug this; the above "no reply" rule shows the following packet: 19:47:07.707346 IP [my laptop's ip address].39679 > 64.61.61.112.http: S 4212369272:4212369272(0) win 5840 <mss 1460,sackOK,timestamp 1264677320 0,nop,wscale 2>
So, I'm still stumped.
The exact iptables rules are below.
Any other thoughts? There's not something besides /proc/sys/net/ipv4/ ip_forward that needs to be twiddled, is there?
best, Jeff
% iptables -L -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 197 20881 RH-Firewall-1-INPUT all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 RH-Firewall-1-INPUT all -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 139 packets, 36106 bytes) pkts bytes target prot opt in out source destination
Chain RH-Firewall-1-INPUT (2 references) pkts bytes target prot opt in out source destination 8 1688 ACCEPT all -- lo any anywhere anywhere 1 84 ACCEPT icmp -- any any anywhere anywhere icmp any 0 0 ACCEPT ipv6-crypt-- any any anywhere anywhere 0 0 ACCEPT ipv6-auth-- any any anywhere anywhere 0 0 ACCEPT udp -- any any anywhere 224.0.0.251 udp dpt:5353 0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:ipp 181 18689 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED 2 120 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ssh 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:http 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:webcache 5 300 ACCEPT tcp -- eth1 any anywhere anywhere tcp dpt:5666 0 0 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited
-- Jeff Potter http://www.atof.net/go/boston