2

I have a webserver which is running on ip address 192.168.11.100

How can i use iptables to redirect all web traffic (http and https) to my webserver on LAN?

After that i want to add except list mac address to this rule. How can i do that?

I tried this command but nothing happened with LAN IP.

iptables -t nat -I PREROUTING -p tcp --dport 80  -j DNAT --to-destination 192.168.11.100

Update: with command above it seems like get affect. But i don't know why the result is: the webpage is not available.

But when i access 192.168.11.100 the server return me a index page. So how should i do?

Thank you!

  • What is the port number of 192.168.11.100 you are forwarding traffic to? – heemayl Feb 22 '15 at 18:34
  • It is 80 - 192.168.11.100:80 because that is a web server – Trần Minh Phương Feb 22 '15 at 18:36
  • Try this iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 192.168.11.100:80 ..replace eth0 with the actual interface. – heemayl Feb 22 '15 at 18:42
  • I tried iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.11.100:80 but nothing happend! :( – Trần Minh Phương Feb 22 '15 at 18:49
  • Did you have the FORWARD and INPUT chain rules set beforehand to allow traffic on 80 and 443 ports? – heemayl Feb 22 '15 at 18:51
1

You can try:

 iptables -t nat -A PREROUTING -p tcp -m multiport --dport 80,443 -i eth0 -d 192.168.11.100  -j DNAT --to-destination 192.168.11.100

You have to change interface eth0

  • I changed interface eth0 to my wireless interface ath0, but nothing happened! "-d 192.168.11.100" what is this mean? – Trần Minh Phương Feb 22 '15 at 19:19
  • -d agains of -s : -d means desination address, -s : source address. – PersianGulf Feb 22 '15 at 19:22
  • A good solution , eliminate -i YOUR_WIRELESS – PersianGulf Feb 22 '15 at 19:23
  • I used -i ath0 but nothing happened! – Trần Minh Phương Feb 22 '15 at 19:31
  • I say eliminate, eliminate means remove. – PersianGulf Feb 22 '15 at 19:41
0

Okay! My problem has been solve.

I used this command (like i posted above)

iptables -t nat -I PREROUTING -p tcp --dport 80  -j DNAT --to-destination 192.168.11.100

I don't know that is working because i tested on computer has ip address 192.168.11.100.

When i use mobile to connect to my network, it works!

So thank you guys so much for helping me!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.