Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80.

There are certain sites I'd like to block, but not by dropping the packet, but by redirecting them to a blocked.html page being served by a local web server.

I have two nics. The one on the internet side is bound to 10.0.2.15. If I do a DNAT rule to redirect traffic to my web server using the internet NIC, the page is returned. If i redirect to 127.0.0.1, it is not.

Why is that?

Here is my IPTables configuration:

# iptables -S
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT 
# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N block-chain
-A PREROUTING -j block-chain 
-A POSTROUTING -o eth1 -j MASQUERADE 
# THIS WILL NOT RETURN THE PAGE TO THE CLIENT
-A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 127.0.0.1:80 
# THIS WILL
-A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 10.0.2.15:80 
-A block-chain -j RETURN 
share|improve this question

migrated from security.stackexchange.com Jun 19 at 23:36

This question came from our site for Information security professionals.

1 Answer 1

-j DNAT --to-destination 127.0.0.1:80 is redirecting clients to look at their own loopback address for a web page.

Stick with -A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 10.0.2.15:80

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.