iptables - Redirect web traffic to LAN Server

Question

I have a webserver which is running on ip address 192.168.11.100

How can i use iptables to redirect all web traffic (http and https) to my webserver on LAN?

After that i want to add except list mac address to this rule. How can i do that?

I tried this command but nothing happened with LAN IP.

iptables -t nat -I PREROUTING -p tcp --dport 80  -j DNAT --to-destination 192.168.11.100

Update: with command above it seems like get affect. But i don't know why the result is: the webpage is not available.

But when i access 192.168.11.100 the server return me a index page. So how should i do?

Thank you!

What is the port number of 192.168.11.100 you are forwarding traffic to? — heemayl, Feb 22, 2015 at 18:34
Try this iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 192.168.11.100:80 ..replace eth0 with the actual interface. — heemayl, Feb 22, 2015 at 18:42
I tried iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.11.100:80 but nothing happend! :( — Trần Minh Phương, Feb 22, 2015 at 18:49
Did you have the FORWARD and INPUT chain rules set beforehand to allow traffic on 80 and 443 ports? — heemayl, Feb 22, 2015 at 18:51

PersianGulf · Accepted Answer · 2015-02-22 19:12:56Z

1

You can try:

 iptables -t nat -A PREROUTING -p tcp -m multiport --dport 80,443 -i eth0 -d 192.168.11.100  -j DNAT --to-destination 192.168.11.100

You have to change interface eth0

answered Feb 22, 2015 at 19:12

PersianGulf

10.7k9 gold badges52 silver badges78 bronze badges

I changed interface eth0 to my wireless interface ath0, but nothing happened! "-d 192.168.11.100" what is this mean?
– Trần Minh Phương
Feb 22, 2015 at 19:19
-d agains of -s : -d means desination address, -s : source address.
– PersianGulf
Feb 22, 2015 at 19:22
A good solution , eliminate -i YOUR_WIRELESS
– PersianGulf
Feb 22, 2015 at 19:23
I used -i ath0 but nothing happened!
– Trần Minh Phương
Feb 22, 2015 at 19:31
I say eliminate, eliminate means remove.
– PersianGulf
Feb 22, 2015 at 19:41

| Show 1 more comment

Trần Minh Phương · Accepted Answer · 2015-02-22 20:17:47Z

1

Okay! My problem has been solve.

I used this command (like i posted above)

iptables -t nat -I PREROUTING -p tcp --dport 80  -j DNAT --to-destination 192.168.11.100

I don't know that is working because i tested on computer has ip address 192.168.11.100.

When i use mobile to connect to my network, it works!

So thank you guys so much for helping me!

answered Feb 22, 2015 at 20:17

1432 silver badges7 bronze badges

Add a comment |

2 Answers 2