I'm trying to redirect all traffic on my wifi router to a local webserver using iptables. I'm not sure I have got the command right and also I want to exclude the router IP ( from the rule to prevent myself from locking myself out from accessing the router.

What I've come up with so far:

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to

I tested above and it cause me not to be able to access the router again and the redirect is not working. What am I doing wrong, and how can exclude from being redirected to

Setup: is the IP for the webserver is my router (dd-wrt) no internet connection.

Example of what I'm trying to achieve:

  • User connects to wifi hotspot, trying to access www.siteA.com, gets redirected to (/index.html)
  • User connects to wifi hotspot, trying to access www.siteB.com, gets redirected to (/index.html)
  • User tries to access and no direction takes place
  • You doing this iptables stuff in you wifi router?
    – tachomi
    Feb 2, 2016 at 22:06
  • If malyy's answer solved your (asked) problem, please indicate so with the checkmark next to it. Thank you!
    – Jeff Schaller
    Jun 26, 2016 at 13:14
  • I'm sorr for forgetting to close the question! I ended up using the dnsmasq in the dd-wrt router, eg. address=/thedomain.com/
    – D. Eight
    Jun 27, 2016 at 22:44

1 Answer 1


All you need is this single rule:

iptables -t nat -I PREROUTING --src 0/0 --dst 

This will insert into PREROUTING chain (?=-I) of the nat table (-t nat) the rule, that says:

Any incomming (-src 0/0) packets with destination address (--dst

Things to remember are: To redirect incoming traffic means inserting rules into PREROUTING chain of the nat table. Redirection is done only for specified interface. More in man iptables, search for REDIRECT keyword.

--append PREROUTING  --source --jump RETURN

RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

  • Thank you for the reply, I tried this but have ran into some other issues which have lead me to the need of possibly creating a proxy / captive portal sollution instead as I will most likely run into problems with https -> http redirects, URI etc... But thanks for the reply!
    – D. Eight
    Feb 1, 2016 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.