0

I'm using iptables to block Internet (by redirecting to an internal server) access on devices connected to my hotspot. That's my command:

iptables -t nat -I PREROUTING -p tcp -s 192.168.43.51 -j DNAT --to-destination 192.168.43.1:12345
iptables -t nat -I PREROUTING -p udp -s 192.168.43.51 ! --dport 53 -j DNAT --to-destination 192.168.43.1:12345

192.168.43.51 is the device I'm blocking and 192.168.43.1:12345 is the internal server. So it's working but there is a delay between real blocking and command execution. For example while I'm downloading a file, I am executing that command but file keeps downloading for a 5-15(apprx.) seconds while the user can consume some additional data. How can it be solved?

2

Block it in the OUTPUT rule except to your IP too.

iptables -I FORWARD -s 192.168.43.51 ! -d 192.168.43.1 -j DROP
iptables -I FORWARD  -m state --state ESTABLISHED,RELATED -s 192.167.43.51 ! -d 192.168.43.1 -j DROP
  • Could you please write a full command? I'm pretty new to iptables stuff. Thanks. – sssemil Nov 14 '15 at 18:35
  • Done. Edited it a few times to get it right. – Rui F Ribeiro Nov 14 '15 at 18:45
  • Nope, it's not helping. Thanks for trying. – sssemil Nov 14 '15 at 18:46
  • Odd. I suspect it must have to be something related with optimisations and/or conntrack, however I have no idea how to get around it. – Rui F Ribeiro Nov 14 '15 at 18:51
  • I remembered there are the RELATED rules. In 20 minutes I can give you an example if you have not find it by them (dining here) – Rui F Ribeiro Nov 14 '15 at 19:03
0

So, here is solution that worked:

iptables -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -s 192.168.43.51 ! -d 192.168.43.1 -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.