3

I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80.

There are certain sites I'd like to block, but not by dropping the packet, but by redirecting them to a blocked.html page being served by a local web server.

I have two nics. The one on the internet side is bound to 10.0.2.15. If I do a DNAT rule to redirect traffic to my web server using the internet NIC, the page is returned. If i redirect to 127.0.0.1, it is not.

Why is that?

Here is my IPTables configuration:

# iptables -S
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT 
# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N block-chain
-A PREROUTING -j block-chain 
-A POSTROUTING -o eth1 -j MASQUERADE 
# THIS WILL NOT RETURN THE PAGE TO THE CLIENT
-A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 127.0.0.1:80 
# THIS WILL
-A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 10.0.2.15:80 
-A block-chain -j RETURN 

migrated from security.stackexchange.com Jun 19 '14 at 23:36

This question came from our site for information security professionals.

1

For localhost you need to use REDIRECT instead of DNAT. In your example:

-A block-chain -d 206.190.36.45/32 -p tcp -j REDIRECT --to-ports 80

0

-j DNAT --to-destination 127.0.0.1:80 is redirecting clients to look at their own loopback address for a web page.

Stick with -A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 10.0.2.15:80

  • -j DNAT --to-destination 127.0.0.1:80 is redirecting clients to look at their own loopback address for a web page. Not true. This is not a HTTP redirect, it does not have any effect on the clients themselves, only on the traffic sent bt them. – Bart Polot Dec 14 '15 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy