3

I'm trying to redirect all traffic on my wifi router to a local webserver using iptables. I'm not sure I have got the command right and also I want to exclude the router IP (172.16.0.1) from the rule to prevent myself from locking myself out from accessing the router.

What I've come up with so far:

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to 172.16.0.2:80
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 172.16.0.2:80

I tested above and it cause me not to be able to access the router again and the redirect is not working. What am I doing wrong, and how can exclude 172.16.0.1 from being redirected to 172.16.0.2?

Setup: 172.16.0.2 is the IP for the webserver 172.16.0.1 is my router (dd-wrt) no internet connection.

Example of what I'm trying to achieve:

  • User connects to wifi hotspot, trying to access www.siteA.com, gets redirected to 172.16.0.2 (/index.html)
  • User connects to wifi hotspot, trying to access www.siteB.com, gets redirected to 172.16.0.2 (/index.html)
  • User tries to access 172.16.0.1 and no direction takes place
  • You doing this iptables stuff in you wifi router? – tachomi Feb 2 '16 at 22:06
  • If malyy's answer solved your (asked) problem, please indicate so with the checkmark next to it. Thank you! – Jeff Schaller Jun 26 '16 at 13:14
  • I'm sorr for forgetting to close the question! I ended up using the dnsmasq in the dd-wrt router, eg. address=/thedomain.com/172.16.0.2 – D. Eight Jun 27 '16 at 22:44
4

All you need is this single rule:

iptables -t nat -I PREROUTING --src 0/0 --dst 172.16.0.2 

This will insert into PREROUTING chain (?=-I) of the nat table (-t nat) the rule, that says:

Any incomming (-src 0/0) packets with destination address 172.16.0.2 (--dst 172.16.0.2).

Things to remember are: To redirect incoming traffic means inserting rules into PREROUTING chain of the nat table. Redirection is done only for specified interface. More in man iptables, search for REDIRECT keyword.

--append PREROUTING  --source 172.16.0.1 --jump RETURN

RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

  • Thank you for the reply, I tried this but have ran into some other issues which have lead me to the need of possibly creating a proxy / captive portal sollution instead as I will most likely run into problems with https -> http redirects, URI etc... But thanks for the reply! – D. Eight Feb 1 '16 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.