1

This is for raspbian acting as a gateway.

computers -> [eth1] raspberry pi (dhcp) [eth0] -> modem/router -> internet

I made an ip forwarding rule which redirects all traffic coming from eth1 (10.1.1.x) to eth0 which is connected to a modem/router (192.168.2.1) which sends traffic to the internets.

This works, computers inside 10.1.1.x which are connected to eth1 of raspberry pi can go to the internet fine.

I'm looking for:

  1. netfilter rules which by default forward all web (port 80 and port 443) traffic to a local website (10.1.1.1:80) and
  2. other rules which add exceptions to that rule to allow certain machines via their mac addresses (or ip if that's not possible) to go to the internet as usual.

I wrote this which redirects requests for port 80 to local website:

iptables -t nat -A OUTPUT -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.1.1.1:80

But this one doesn't work, I can't redirect to different port:

iptables -t nat -A OUTPUT -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.1.1.1:80

I also couldn't find how to write exceptions to this rule to forward certain macs/ips as usual.

  • Can't answer your question but usually, exceptions to generic rules are created by placing a new rule earlier in the execution order with some sort of -j jump target that stops execution (like RETURN, ACCEPT, DROP, etc) that way it never reaches the generic rule later on. – Bratchley Jan 13 '15 at 18:51
  • @Bratchley thanks, perhaps I can use some accept rules above the general rule and flush that to iptables to "add exceptions" later – nurettin Jan 13 '15 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.