3

I have a webserver which is running on ip address 192.168.11.100

How can i use iptables to redirect all web traffic (http and https) to my webserver on LAN?

After that i want to add except list mac address to this rule. How can i do that?

I tried this command but nothing happened with LAN IP.

iptables -t nat -I PREROUTING -p tcp --dport 80  -j DNAT --to-destination 192.168.11.100

Update: with command above it seems like get affect. But i don't know why the result is: the webpage is not available.

But when i access 192.168.11.100 the server return me a index page. So how should i do?

Thank you!

12
  • What is the port number of 192.168.11.100 you are forwarding traffic to?
    – heemayl
    Feb 22, 2015 at 18:34
  • It is 80 - 192.168.11.100:80 because that is a web server Feb 22, 2015 at 18:36
  • Try this iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 192.168.11.100:80 ..replace eth0 with the actual interface.
    – heemayl
    Feb 22, 2015 at 18:42
  • I tried iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.11.100:80 but nothing happend! :( Feb 22, 2015 at 18:49
  • Did you have the FORWARD and INPUT chain rules set beforehand to allow traffic on 80 and 443 ports?
    – heemayl
    Feb 22, 2015 at 18:51

2 Answers 2

1

You can try:

 iptables -t nat -A PREROUTING -p tcp -m multiport --dport 80,443 -i eth0 -d 192.168.11.100  -j DNAT --to-destination 192.168.11.100

You have to change interface eth0

6
  • I changed interface eth0 to my wireless interface ath0, but nothing happened! "-d 192.168.11.100" what is this mean? Feb 22, 2015 at 19:19
  • -d agains of -s : -d means desination address, -s : source address. Feb 22, 2015 at 19:22
  • A good solution , eliminate -i YOUR_WIRELESS Feb 22, 2015 at 19:23
  • I used -i ath0 but nothing happened! Feb 22, 2015 at 19:31
  • I say eliminate, eliminate means remove. Feb 22, 2015 at 19:41
1

Okay! My problem has been solve.

I used this command (like i posted above)

iptables -t nat -I PREROUTING -p tcp --dport 80  -j DNAT --to-destination 192.168.11.100

I don't know that is working because i tested on computer has ip address 192.168.11.100.

When i use mobile to connect to my network, it works!

So thank you guys so much for helping me!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .