Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is a iptables set of rules that will force hosts connected to a access point, that try to access any website (port 80 of any ip or hostname) to be redirected to another device on the network (Which is actually seperate).

For example the second server (hosting the web server) is connected via ethernet, and has a IP of (eth0)

The primary server hosts a wireless hotspot (from adapter wlan0ap), and has an ip of I want to make it so that any wifi users of the hotspot (in the network) that try to access or or google.com:80 will be forcefully redirected to

Currently I have tried these rules in combination with enabling net.ipv4.ip_forward=1 settings in sysctl

sudo iptables -A POSTROUTING -t nat -o wlan0ap -j MASQUERADE
sudo iptables -t mangle -N internet
sudo iptables -t mangle -A PREROUTING -i wlan0ap -p tcp -m tcp --dport 80 -j internet
sudo iptables -t mangle -A PREROUTING -i wlan0ap -p tcp -m tcp --dport 443 -j internet
sudo iptables -t mangle -A internet -j MARK --set-mark 99
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp -m mark --mark 99 -m tcp --dport 80 -j DNAT --to-destination
share|improve this question

Following rules should work (not tested):

iptables -t nat -A PREROUTING -i wlan0ap -p tcp --dport 80 -j DNAT  --to-destination
iptables -t nat -A PREROUTING -i wlan0ap -p tcp --dport 430 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -j MASQUERADE
share|improve this answer
Why eth1 not eth0? – aBitPastOne May 28 '14 at 0:15
@aBitPastOne sorry, it should be wlan0ap instead of eth0. Answer is fixed. – jofel May 28 '14 at 15:24

you can use a option multiport. To redict all trafic on port 80,443 you can use:

iptables -t nat -A PREROUTING -i wlan0ap -p tcp -m multiport 80,443 -j DNAT --to-destination

If any user use de portal to login,

iptables -t nat -A PREROUTING -i wlan0ap -s ip_user -p tcp -ACCEPT

Our replace -s Ip -mac --source mac MAC

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.