Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router with dd-wrt. I have a firewall running to direct all traffic through an external proxy. It works great except that it also redirects local Ips and my proxy does not allow Ips, so I can not access my router Web administration.

The firewall I have running is:

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to 
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 

What can I add to this to access my router ip?

share|improve this question
Please once modify rule as I mentioned in my answer, right now I don't have machine to test.. so please let me know if you face any issue – Rahul Patil Sep 13 '13 at 15:25

You can use ! -s or -d to exclude some IP/Network

From man iptables

[!] -s, --source address[/mask][,...]
     Source specification. Address can be either a network name, a hostname,  a
     network  IP address (with /mask), or a plain IP address. Hostnames will be
     resolved once only, before the rule is submitted to  the  kernel.   Please
     note  that  specifying any name to be resolved with a remote query such as
     DNS is a really bad idea.  The mask can be either  a  network  mask  or  a
     plain number, specifying the number of 1's at the left side of the network
     mask.  Thus, a mask of 24 is equivalent to  A "!"  argument
     before  the  address  specification  inverts the sense of the address. The
     flag --src is an alias for this option.  Multiple addresses can be  speciâ
     fied,  but  this  will  expand to multiple rules (when adding with -A), or
     will cause multiple rules to be deleted (with -D).

[!] -d, --destination address[/mask][,...]
     Destination specification.  See the description of the  -s  (source)  flag
     for  a detailed description of the syntax.  The flag --dst is an alias for
     this option

So your rule should to exclude particular ip

iptables -t nat -A PREROUTING -i br0 '!' -d IPAddrOfyourRouter/32 -p tcp --dport 80 -j DNAT --to 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.