I've successfully set up access point on my server using wifi-ap snap

wakatana@server:~$ sudo wifi-ap.config get
debug: false
dhcp.lease-time: 12h
disabled: false
share.disabled: false
share.network-interface: eth0
wifi.channel: 6
wifi.hostapd-driver: nl80211
wifi.interface: wlan0
wifi.interface-mode: direct
wifi.operation-mode: g
wifi.security: wpa2
wifi.security-passphrase: passwordpassword
wifi.ssid: Ubuntu

Now I would like to route all traffic from connected clients to one particular IP_ADDRESS:PORT (at the time it is the same machine as AP runs on). It should work like if client goes e.g. to www.google.com it will be redirected to

If I understand correctly there are at least two possible solutions for this but I do not know how to make it work in practice:

  1. dnsmasq + nginx - I've never did that before so it seems over complicated to me and I do not know if it wont broke my current DNS
  2. iptables - here I have basic iptables experiences but I'm lost in PREROUING, POSTROUTING, DNAT, SNAT etc.

I've tried following

$ sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 555 -j DNAT --to-destination
$ sudo iptables -t nat -nvL PREROUTING
Chain PREROUTING (policy ACCEPT 14 packets, 1116 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1852  351K DOCKER     all  --  *      *              ADDRTYPE match dst-type LOCAL
    0     0 DNAT       tcp  --  wlan0  *              tcp dpt:555 to:

but it does not have any effect:

  • Please detail what you have done until now. The question is overly broad, and denotes a lack of effort, there are many questions in our group how to intercept traffic using iptables. Please see our faq. – Rui F Ribeiro Feb 15 at 5:46
  • @RuiFRibeiro I've added further details – Wakan Tanka Feb 15 at 10:09
sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 555 -j DNAT --to-destination

Your current rule will only redirect traffic going to <some_server>:555 to HTTP uses port 80 and HTTPS uses 443, so neither of those will match the above rule.

Also, instead of DNAT, you'll want to use REDIRECT in this specific case, as you're changing the destination of packets from (not-this-host) to (this-host).

This is for HTTP:

sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-ports 555

For HTTPS, you would probably have to set up another copy of your service with SSL/TLS enabled. Assuming that you'd place it to port 4555, the rule for HTTPS would be:

sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIRECT --to-ports 4555

... and your next problem could be that the modern web browsers won't accept just any random certificate when they are supposed to be connecting to Google over HTTPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.