iptables Proxy Interception: Match Ports 80 and 443 as a Set
Match ports 80 and 443 as a set while keeping client address selection separate from the proxy’s rewritten endpoint.
To select TCP traffic whose destination port is either 80 or 443, use a set:
-p tcp -m multiport --dports 80,443By comparison, --dport 80:443 selects the entire inclusive range from 80 through 443. That catches many additional ports. The comma and colon express different policies.
These are matching fragments, not complete firewall commands. Add them to the chain and action required by the interception design.
| Selector | What it identifies before the rewrite |
|---|---|
-s 192.0.2.20 | The source client address |
-d 198.51.100.30 | The destination server address |
--dports 80,443 | The destination service ports |
The address supplied to DNAT’s --to-destination is the new destination, such as the proxy listener. It does not replace the meaning of the preceding source and destination matches.
Keep the selector narrow enough to describe the intended clients and traffic. In particular, account for connections generated by the proxy itself so that its onward requests do not re-enter the same interception path. Selecting port 443 also does not change the bytes on that connection into an explicit HTTP proxy request; the receiving application still needs the appropriate interception mode. For transparent TCP-to-proxy forwarding, a translator must recover the original destination and negotiate the proxy protocol.