IPTables: Redirect Privileged to Stealthed, Non-Privileged Port

iptables-redirect-lo-hi.sh

#!/bin/sh

FW='/sbin/iptables'

IP='123.123.123.123'  # public ip
LO=80                 # privileged port
HI=8000               # non-privileged port
PM=0x2a               # packet mark - 32bit integer

# allow input on both ports

$FW -A INPUT -d $IP -p tcp --dport $LO -j ACCEPT
$FW -A INPUT -d $IP -p tcp --dport $HI -j ACCEPT

$FW -t mangle -A PREROUTING -d $IP -p tcp --dport $LO -j MARK --set-mark $PM    # mark
$FW -t nat -A PREROUTING -d $IP -p tcp --dport $LO -j REDIRECT --to-ports $HI   # redirect
$FW -A INPUT -d $IP -p tcp --dport $HI -m mark ! --mark $PM -j REJECT           # stealth

exit 0