Skip to content

Instantly share code, notes, and snippets.

@ijmorgado

ijmorgado/node-on-ec2-port-80.txt

Forked from kentbrew/node-on-ec2-port-80.md
Created June 3, 2013 05:54
Show Gist options
  • Save ijmorgado/5696314 to your computer and use it in GitHub Desktop.
Save ijmorgado/5696314 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 5 additions and 6 deletions.
    11 changes: 5 additions & 6 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)

    ## The temptingly easy but *very very wrong* solution:
    ## The temptingly easy but ultimately wrong solution:

    Alter the port the script talks to from 8000 to 80:

    @@ -14,13 +14,14 @@ Alter the port the script talks to from 8000 to 80:

    This is a Bad Idea, for all the standard reasons. (Here's one: if Node has access to the filesystem for any reason, you're hosed.)


    ## One possibly-right way:

    Add a port forwarding rule via `iptables`.

    ## Oh dear familiar feeling: you are a total n00b and know not one thing about iptables!
    ### Oh dear familiar feeling: you are a total n00b and know not one thing about iptables.

    No worries; turns out you only need to add a single rule. First, I listed the rules currently running on the NAT (Network Address Translation) table:
    First, I listed the rules currently running on the NAT (Network Address Translation) table:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    @@ -33,7 +34,7 @@ No worries; turns out you only need to add a single rule. First, I listed the r
    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    I saw nothing, so I felt free to add a rule bouncing packets from external port 80 to internal port 8000:
    I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:

    `[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000`

    @@ -61,8 +62,6 @@ I did not do this myself but throughout this process I had a very strong feeling

    ## Acknowledgements:

    [an example](http://example.com/ "Title")

    - [@rckenned](http://twitter.com/rckenned),
    - [@jrconlin](http://twitter.com/jrconlin),
    - [@spullara](http://twitter.com/spullara),
  2. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 4 additions and 5 deletions.
    9 changes: 4 additions & 5 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)

    ## The temptingly easy but ultimately wrong solution:
    ## The temptingly easy but *very very wrong* solution:

    Alter the port the script talks to from 8000 to 80:

    @@ -14,14 +14,13 @@ Alter the port the script talks to from 8000 to 80:

    This is a Bad Idea, for all the standard reasons. (Here's one: if Node has access to the filesystem for any reason, you're hosed.)


    ## One possibly-right way:

    Add a port forwarding rule via `iptables`.

    ### Oh dear familiar feeling: you are a total n00b and know not one thing about iptables.
    ## Oh dear familiar feeling: you are a total n00b and know not one thing about iptables!

    First, I listed the rules currently running on the NAT (Network Address Translation) table:
    No worries; turns out you only need to add a single rule. First, I listed the rules currently running on the NAT (Network Address Translation) table:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    @@ -34,7 +33,7 @@ First, I listed the rules currently running on the NAT (Network Address Translat
    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:
    I saw nothing, so I felt free to add a rule bouncing packets from external port 80 to internal port 8000:

    `[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000`

  3. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 6 additions and 6 deletions.
    12 changes: 6 additions & 6 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -2,8 +2,6 @@

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)

    [an example](http://example.com/ "Title")

    ## The temptingly easy but ultimately wrong solution:

    Alter the port the script talks to from 8000 to 80:
    @@ -64,8 +62,10 @@ I did not do this myself but throughout this process I had a very strong feeling

    ## Acknowledgements:

    - [http://twitter.com/rckenned](@rckenned),
    - [http://twitter.com/jrconlin](@jrconlin),
    - [http://twitter.com/spullara](@spullara),
    - [http://twitter.com/frozentux](@frozentux) for <http://iptables.rlworkman.net/chunkyhtml>, which is a pretty definitive iptables tutorial.
    [an example](http://example.com/ "Title")

    - [@rckenned](http://twitter.com/rckenned),
    - [@jrconlin](http://twitter.com/jrconlin),
    - [@spullara](http://twitter.com/spullara),
    - [@frozentux](http://twitter.com/frozentux) for <http://iptables.rlworkman.net/chunkyhtml>, which is a pretty definitive iptables tutorial.

  4. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -2,6 +2,7 @@

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)

    [an example](http://example.com/ "Title")

    ## The temptingly easy but ultimately wrong solution:

  5. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 5 additions and 3 deletions.
    8 changes: 5 additions & 3 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -51,15 +51,17 @@ I checked my Node script, which was running on port 8000, and (yes!) it was resp

    ## Fumbling

    During my early fumbling I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:
    During my early attempts I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1

    This removed the first line from the `PREROUTING` chain in my nat table.

    *Final note: I did not do this myself but throughout this process I had a very strong feeling I should be very careful not to screw up port 22, which was my only way in.*
    ## Careful, now....

    ## Thank You:
    I did not do this myself but throughout this process I had a very strong feeling I should be very careful not to screw up port 22, which was my only way in.

    ## Acknowledgements:

    - [http://twitter.com/rckenned](@rckenned),
    - [http://twitter.com/jrconlin](@jrconlin),
  6. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 8 additions and 10 deletions.
    18 changes: 8 additions & 10 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -44,15 +44,9 @@ When I listed again, I saw a new PREROUTING chain:
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination

    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    I checked my Node script, which was running on port 8000, and (yes!) it was responding on port 80.

    ## Fumbling
    @@ -67,4 +61,8 @@ This removed the first line from the `PREROUTING` chain in my nat table.

    ## Thank You:

    [http://twitter.com/rckenned](@rckenned), [http://twitter.com/jrconlin](@jrconlin), and [http://twitter.com/spullara](@spullara), and see also <http://iptables.rlworkman.net/chunkyhtml> for a pretty definitive-looking iptables tutorial from [http://twitter.com/frozentux](@frozentux).
    - [http://twitter.com/rckenned](@rckenned),
    - [http://twitter.com/jrconlin](@jrconlin),
    - [http://twitter.com/spullara](@spullara),
    - [http://twitter.com/frozentux](@frozentux) for <http://iptables.rlworkman.net/chunkyhtml>, which is a pretty definitive iptables tutorial.

  7. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 6 additions and 12 deletions.
    18 changes: 6 additions & 12 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -52,19 +52,11 @@ When I listed again, I saw a new PREROUTING chain:

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    [ec2-user@ip-10-205-14-7 ~]$ sudo iptables -t nat -L
    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination


    I checked my Node script, which was running on port 8000, and (yes!) it was responding on port 80.

    ## Fumbling

    During my early fumbling I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1
    @@ -73,4 +65,6 @@ This removed the first line from the `PREROUTING` chain in my nat table.

    *Final note: I did not do this myself but throughout this process I had a very strong feeling I should be very careful not to screw up port 22, which was my only way in.*

    Thanks to [http://twitter.com/rckenned](@rckenned), [http://twitter.com/jrconlin](@jrconlin), and [http://twitter.com/spullara](@spullara), and see also <http://iptables.rlworkman.net/chunkyhtml> for a pretty definitive-looking iptables tutorial from [http://twitter.com/frozentux](@frozentux).
    ## Thank You:

    [http://twitter.com/rckenned](@rckenned), [http://twitter.com/jrconlin](@jrconlin), and [http://twitter.com/spullara](@spullara), and see also <http://iptables.rlworkman.net/chunkyhtml> for a pretty definitive-looking iptables tutorial from [http://twitter.com/frozentux](@frozentux).
  8. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -27,13 +27,13 @@ First, I listed the rules currently running on the NAT (Network Address Translat
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain INPUT (policy ACCEPT)
    target prot opt source destination
    target prot opt source destination

    Chain FORWARD (policy ACCEPT)
    target prot opt source destination
    target prot opt source destination

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination
    target prot opt source destination

    I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:

  9. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 25 additions and 33 deletions.
    58 changes: 25 additions & 33 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -24,58 +24,50 @@ Add a port forwarding rule via `iptables`.

    First, I listed the rules currently running on the NAT (Network Address Translation) table:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain INPUT (policy ACCEPT)
    target prot opt source destination
    Chain INPUT (policy ACCEPT)
    target prot opt source destination

    Chain FORWARD (policy ACCEPT)
    target prot opt source destination
    Chain FORWARD (policy ACCEPT)
    target prot opt source destination

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination
    ```
    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000
    ```
    `[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000`

    When I listed again, I saw a new PREROUTING chain:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000
    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination
    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    [ec2-user@ip-10-205-14-7 ~]$ sudo iptables -t nat -L
    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000
    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    [ec2-user@ip-10-205-14-7 ~]$ sudo iptables -t nat -L
    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination
    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    ```
    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination

    I checked my Node script, which was running on port 8000, and (yes!) it was responding on port 80.

    During my early fumbling I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1
    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1

    This removed the first line from the `PREROUTING` chain in my nat table.

  10. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,7 @@
    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)


    ## The temptingly easy but ultimately wrong solution
    ## The temptingly easy but ultimately wrong solution:

    Alter the port the script talks to from 8000 to 80:

    @@ -16,7 +16,7 @@ Alter the port the script talks to from 8000 to 80:
    This is a Bad Idea, for all the standard reasons. (Here's one: if Node has access to the filesystem for any reason, you're hosed.)


    ## One possibly-right way
    ## One possibly-right way:

    Add a port forwarding rule via `iptables`.

  11. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@ Standard practices say no non-root process gets to talk to the Internet on a por

    Alter the port the script talks to from 8000 to 80:

    }).listen(80);
    }).listen(80);

    .. and run it as root:

  12. @kentbrew kentbrew revised this gist Jul 20, 2012. 1 changed file with 18 additions and 15 deletions.
    33 changes: 18 additions & 15 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1,30 +1,30 @@
    THE PROBLEM:
    ## The Problem

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)


    THE TEMPTINGLY EASY BUT TOTALLY WRONG SOLUTION:
    ## The temptingly easy but ultimately wrong solution

    Alter the port the script talks to from 8000 to 80:

    }).listen(80);
    }).listen(80);

    .. and run it as root:

    sudo /usr/local/bin/node foo.js
    sudo /usr/local/bin/node foo.js

    This is a Bad Idea, for all the standard reasons. (Here's one: if Node has access to the filesystem for any reason, you're hosed.)


    ONE POSSIBLE RIGHT WAY:
    ## One possibly-right way

    Add a port forwarding rule via iptables.
    Add a port forwarding rule via `iptables`.


    OH DEAR FAMILIAR FEELING YOU ARE A TOTAL N00B AND KNOW NOT ONE THING ABOUT IPTABLES.
    ### Oh dear familiar feeling: you are a total n00b and know not one thing about iptables.

    First, I listed the rules currently running on the NAT (Network Address Translation) table:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain INPUT (policy ACCEPT)
    @@ -35,13 +35,17 @@ target prot opt source destination

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination
    ```

    I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000
    ```

    When I listed again, I saw a new PREROUTING chain:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain PREROUTING (policy ACCEPT)
    @@ -63,19 +67,18 @@ target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    ```

    I checked my Node script, which was running on port 8000, and (yes!) it was responding on port 80.

    During my early fumbling I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:

    ```
    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1
    ```

    This removed the first line from the PREROUTING chain in my nat table.


    FINAL NOTE: I DID NOT DO THIS MYSELF BUT I HAVE A VERY STRONG FEELING I SHOULD BE VERY CAREFUL NOT TO SCREW UP PORT 22, WHICH IS MY ONLY WAY IN.


    Thanks to @rckenned, @jrconlin, and @spullara ... see also http://iptables.rlworkman.net/chunkyhtml for a pretty definitive-looking iptables tutorial from @frozentux.
    This removed the first line from the `PREROUTING` chain in my nat table.

    *Final note: I did not do this myself but throughout this process I had a very strong feeling I should be very careful not to screw up port 22, which was my only way in.*

    Thanks to [http://twitter.com/rckenned](@rckenned), [http://twitter.com/jrconlin](@jrconlin), and [http://twitter.com/spullara](@spullara), and see also <http://iptables.rlworkman.net/chunkyhtml> for a pretty definitive-looking iptables tutorial from [http://twitter.com/frozentux](@frozentux).
  13. @kentbrew kentbrew revised this gist Jan 12, 2011. 1 changed file with 1 addition and 4 deletions.
    5 changes: 1 addition & 4 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +1,6 @@
    THE PROBLEM:

    Standard practices say no non-root process gets to talk to the Internet on a port less
    than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go
    as fast as possible and use the smallest possible share of my teeny tiny little
    system's resources, so proxying through nginx or Apache seemed suboptimal.)
    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)


    THE TEMPTINGLY EASY BUT TOTALLY WRONG SOLUTION:
  14. @kentbrew kentbrew revised this gist Jan 12, 2011. 1 changed file with 4 additions and 1 deletion.
    5 changes: 4 additions & 1 deletion node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,9 @@
    THE PROBLEM:

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little system's resources, so proxying through nginx or Apache seemed suboptimal.)
    Standard practices say no non-root process gets to talk to the Internet on a port less
    than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go
    as fast as possible and use the smallest possible share of my teeny tiny little
    system's resources, so proxying through nginx or Apache seemed suboptimal.)


    THE TEMPTINGLY EASY BUT TOTALLY WRONG SOLUTION:
  15. @kentbrew kentbrew created this gist Jan 12, 2011.
    81 changes: 81 additions & 0 deletions node-on-ec2-port-80.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,81 @@
    THE PROBLEM:

    Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little system's resources, so proxying through nginx or Apache seemed suboptimal.)


    THE TEMPTINGLY EASY BUT TOTALLY WRONG SOLUTION:

    Alter the port the script talks to from 8000 to 80:

    }).listen(80);

    .. and run it as root:

    sudo /usr/local/bin/node foo.js

    This is a Bad Idea, for all the standard reasons. (Here's one: if Node has access to the filesystem for any reason, you're hosed.)


    ONE POSSIBLE RIGHT WAY:

    Add a port forwarding rule via iptables.


    OH DEAR FAMILIAR FEELING YOU ARE A TOTAL N00B AND KNOW NOT ONE THING ABOUT IPTABLES.

    First, I listed the rules currently running on the NAT (Network Address Translation) table:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain INPUT (policy ACCEPT)
    target prot opt source destination

    Chain FORWARD (policy ACCEPT)
    target prot opt source destination

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000

    When I listed again, I saw a new PREROUTING chain:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination
    [ec2-user@ip-10-205-14-7 ~]$ sudo iptables -t nat -L
    Chain PREROUTING (policy ACCEPT)
    target prot opt source destination
    REDIRECT tcp -- anywhere anywhere tcp dpt:http redir ports 8000

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

    Chain POSTROUTING (policy ACCEPT)
    target prot opt source destination

    I checked my Node script, which was running on port 8000, and (yes!) it was responding on port 80.

    During my early fumbling I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:

    [ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1

    This removed the first line from the PREROUTING chain in my nat table.


    FINAL NOTE: I DID NOT DO THIS MYSELF BUT I HAVE A VERY STRONG FEELING I SHOULD BE VERY CAREFUL NOT TO SCREW UP PORT 22, WHICH IS MY ONLY WAY IN.


    Thanks to @rckenned, @jrconlin, and @spullara ... see also http://iptables.rlworkman.net/chunkyhtml for a pretty definitive-looking iptables tutorial from @frozentux.