Context: With iptables, I redirect all the traffic - incoming at port 80 - to a distant server IP (X.X.X.X). I aim that anywhat you write in the urlbar of browser, you get X.X.X.X.

  1. IP That works a charm with IP (If I request, I fallback on X.X.X.X).
  2. Resolved Domain (In dnsmasq I set server=, Google DNS): redirect is ok (ex: lolipop.fr => X.X.X.X)
  3. Unresolved Domain : it does not work with domain, e.g. : http://stackexchange.com is not 'redirected' to X.X.X.X. (e.g.: whateverxlkjg.de => DNS UNRESOLVED ERROR)

Obviously, dnsmasq runs before iptables, and return solve error in step 2. Stopping the process...

My question is: How can I ensure IP, Solved domain and unsolved domain traffic redirection with iptables (I cannot/dontwant to use dnsmasq) ?

I understand it is a tricky question... Please be indulgent.

  • How exactly are you redirecting all traffic to port 80? If example.com has a single A record, and traffic destined to that IP address is being redirected, then all "domain" traffic will be redirected. – thrig Sep 2 '15 at 14:35
  • Actually that s ok to me, all is redirected, IP and DOMAIN. But : the unresolved DOMAIN (ex: whatever5453512.fr is not resolved then not redirected). I ve editted my post. – ArchiT3K Sep 2 '15 at 15:14
  • 2
    With no DNS resolution, there is no IP address, and thus nothing for a firewall to act on. Thus, a DNS server must provide an IP address for any unresolved domains. – thrig Sep 2 '15 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.