This is for raspbian acting as a gateway.

computers -> [eth1] raspberry pi (dhcp) [eth0] -> modem/router -> internet

I made an ip forwarding rule which redirects all traffic coming from eth1 (10.1.1.x) to eth0 which is connected to a modem/router ( which sends traffic to the internets.

This works, computers inside 10.1.1.x which are connected to eth1 of raspberry pi can go to the internet fine.

I'm looking for:

  1. netfilter rules which by default forward all web (port 80 and port 443) traffic to a local website ( and
  2. other rules which add exceptions to that rule to allow certain machines via their mac addresses (or ip if that's not possible) to go to the internet as usual.

I wrote this which redirects requests for port 80 to local website:

iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -j DNAT --to-destination

But this one doesn't work, I can't redirect to different port:

iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -j DNAT --to-destination

I also couldn't find how to write exceptions to this rule to forward certain macs/ips as usual.

  • Can't answer your question but usually, exceptions to generic rules are created by placing a new rule earlier in the execution order with some sort of -j jump target that stops execution (like RETURN, ACCEPT, DROP, etc) that way it never reaches the generic rule later on.
    – Bratchley
    Commented Jan 13, 2015 at 18:51
  • @Bratchley thanks, perhaps I can use some accept rules above the general rule and flush that to iptables to "add exceptions" later
    – nurettin
    Commented Jan 13, 2015 at 18:53


You must log in to answer this question.

Browse other questions tagged .