I have an old Mac Mini running Debian Stretch where I have bridged the wifi interface to the ethernet interface like so (/etc/network/interfaces):

source /etc/network/interfaces.d/*

# The loopback & bridge network interfaces
auto lo wlan0 br0
iface lo inet loopback

# wireless wlan0
allow-hotplug wlan0
iface wlan0 inet manual

# The primary network interface
allow-hotplug enp0s10
iface enp0s10 inet dhcp    

# Setup bridge 
iface br0 inet static
    bridge_ports wlan0 enp0s10
    ## isp router ip, also runs DHCPD ##
    dns-nameservers <DNS_MANGLER.com>

The Mac is also running an access-point using hostapd via the bridge mentioned above (/etc/hostapd/hostapd.conf):

### Wireless network name ###
### Set your bridge name ###
## Key management algorithms ##
## Set cipher suites (encryption algorithms) ##
## TKIP = Temporal Key Integrity Protocol
## CCMP = AES in Counter mode with CBC-MAC
## Shared Key Authentication ##
## Accept all MAC address ###

The above setup works fine - I can connect to the web via the access-point as expected.
Here is my problem: there are several 3rd-party websites which I can access only if my DNS queries are routed through a DNS-mangling service - let's say it is located at DNS_MANGLER.com. Rather than configuring a number of household devices to use then not-use this service, I would like the home-made access-point to automagically hijack all DNS requests and redirect them to DNS_MANGLER.com:53
So I add the following rules to iptables:

iptables -t nat -A OUTPUT -p udp --dport 53 ! -j DNAT --to-destination <DNS_MANGLER.com IP>:53
iptables -t nat -A OUTPUT -p tcp --dport 53 ! -j DNAT --to-destination <DNS_MANGLER.com IP>:53

Those are the only rules in my IP tables and net.ipv4.ip_forward has been set to 1. Unfortunately this doesn't work - when I connect to the access-point I am unable to access the 3rd-party sites, presumably because the above redirect is failing. To test this, I install and run srelay to provide a simple SOCKS5 proxy on the Mac. Now if I connect to my access-point and configure Firefox to use the srelay proxy (for DNS queries too) I am able to access the 3rd-party sites. So the iptables rules are working, just not for hostapd.
Where is/are the flaws here?
Do I need to bring dnsmasq into this somehow?
Note that the srelay proxy is not the solution I am looking for here - it is simply a way for me to test that the iptables rules were working.
Setting the DNS nameservers in the DHCP options is not viable either as they can be ignored by the client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.