Skip to content

Instantly share code, notes, and snippets.

@kentbrew
Last active February 4, 2024 19:14
Star You must be signed in to star a gist
Save kentbrew/776580 to your computer and use it in GitHub Desktop.
How I Got Node.js Talking on EC2's Port 80

The Problem

Standard practices say no non-root process gets to talk to the Internet on a port less than 1024. How, then, could I get Node talking on port 80 on EC2? (I wanted it to go as fast as possible and use the smallest possible share of my teeny tiny little micro-instance's resources, so proxying through nginx or Apache seemed suboptimal.)

The temptingly easy but ultimately wrong solution:

Alter the port the script talks to from 8000 to 80:

}).listen(80);

.. and run it as root:

sudo /usr/local/bin/node foo.js

This is a Bad Idea, for all the standard reasons. (Here's one: if Node has access to the filesystem for any reason, you're hosed.)

One possibly-right way:

Add a port forwarding rule via iptables.

Oh dear familiar feeling: you are a total n00b and know not one thing about iptables.

First, I listed the rules currently running on the NAT (Network Address Translation) table:

[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

Chain INPUT (policy ACCEPT)
target     prot opt source    destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source    destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source    destination

I saw nothing, so I felt free to add a rule forwarding packets sent to external port 80 to internal port 8000:

[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8000

When I listed again, I saw a new PREROUTING chain:

[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -L

Chain PREROUTING (policy ACCEPT)
target     prot opt source     destination         
REDIRECT   tcp  --  anywhere   anywhere     tcp dpt:http redir ports 8000 

I checked my Node script, which was running on port 8000, and (yes!) it was responding on port 80.

Fumbling

During my early attempts I screwed up a bunch of times. I removed busted rules by specifying the right table, the right chain, and the right line number, like so:

[ec2-user@ip-XX-XXX-XX-X ~]$ sudo iptables -t nat -D PREROUTING 1

This removed the first line from the PREROUTING chain in my nat table.

Careful, now....

I did not do this myself but throughout this process I had a very strong feeling I should be very careful not to screw up port 22, which was my only way in.

Acknowledgements:

@silveur
Copy link

silveur commented May 15, 2015

thanks so much

@eladnava
Copy link

Excellent work, thanks for your post!

Here's my take on this using nginx as a reverse proxy:
https://eladnava.com/binding-nodejs-port-80-using-nginx/

@Dinesh1991
Copy link

When I use the below command, I am able to redirect from port 3000 to port 80, but I need to redirect to port 80 when a request is for any other port.

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000

@baodinh
Copy link

baodinh commented Mar 10, 2016

Thanks so much, i want to know what is disadvantage of this solution ?

@Alagarasan
Copy link

Thanks man. A great solution. I was breaking my head. Wonderful 👍

@peturh
Copy link

peturh commented Jun 7, 2016

Yup, this did it for me. Tried getting the load balancer up, men feels overkill for my solution.

@nobodhi
Copy link

nobodhi commented Sep 2, 2016

This solution works partially, but will not allow the node server to see the /CSS folder, so all formatting is lost. Same with images, etc.

@JustinWinthers
Copy link

JustinWinthers commented Sep 29, 2016

If you're using AWS, a preferred way is to use cloudfront or an elastic load balancer. You can easily create a cloudfront distribution or classic elastic load balancer that will forward traffic to the port of your choice on your ec2 server. You can even create load balancers with only one ec2 instance if you don't want to use cloudfront. This in my opinion should be preferred as you can also quickly add a ssl certificate to your distribution or load balancer using the AWS certificate manager without any server configuration. Then just simply point your A record(s) to the public DNS for your distribution or load balancer. No code, no hacks, easy as pie.

@rohitarjunagi
Copy link

Worked! Thanks much!

@stavarengo
Copy link

stavarengo commented Nov 19, 2016

Its important to notice that these configurations will be lost after system restarts.
@kentbrew, I added the instructions to make it persistent between restarts. What you think to add it here?
Checkout the updated .MD code.

@artforlife
Copy link

This came useful. Much appreciated!

@thaiMao
Copy link

thaiMao commented Nov 30, 2016

Very useful. Many thanks

@rcarl94
Copy link

rcarl94 commented Dec 2, 2016

Awesome stuff, thank you sir.

@andfinally
Copy link

Thanks! Very handy.

@FoxxMD
Copy link

FoxxMD commented Jun 19, 2017

Thanks @JustinWinthers classic ELB is exactly what I needed 👍

@suman1459
Copy link

When I use the below command, I am able to redirect from port 443 to port 8000, but I also want to redirect my port 80 to 8000 .

sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8000

@FerreiraRaphael
Copy link

awesome! thx a lot

@imZEH
Copy link

imZEH commented Sep 12, 2017

Is there a command that rerouting port from 8000 to 80 upon restart the instance ?
some says use UFW ?

Thanks

@sombek
Copy link

sombek commented Sep 19, 2017

Working!!
Thank you it's really helpful.
spent the last night searching for this problem!

@sombek
Copy link

sombek commented Sep 19, 2017

@imZEH
Why you don't use the elastic IP instead?

@DecentM
Copy link

DecentM commented Sep 20, 2017

I usually just give the node binary permission to open a service port with sudo setcap 'cap_net_bind_service=+ep' $(which node)
(or replace $(which node) with wherever your node binary is if that returns a symlink)

@marwanmakm
Copy link

marwanmakm commented Nov 16, 2020

Excellent bro, It works perfectly!!. Now I can access without problems to my Node.js Server running in my EC2 instance and configure a Domain.

Thank you

@CameronHonis
Copy link

Works even in 2021. You're a legend!

@ravish1729
Copy link

You saved me a ton of time thank you!!!

@TomO2015
Copy link

to save the change in ubuntu
sudo /sbin/iptables-save

@jonbel16
Copy link

jonbel16 commented Oct 7, 2022

Works in 2022. Thank you

@andrei-coelho
Copy link

Very nice! Is still relevant!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment