Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a router (A Netgear WNDR3700 if that matters) with dd-wrt. For content filtering I am using OpenDNS. I wanted to make sure a user could not bypass OpenDNS by putting in their own name servers, so I have a rule to catch all DNS traffic.

iptables -t nat -A PREROUTING -i br0 -p all --dport 53 -j DNAT --to $LAN_IP

I did have one computer on the network I wanted to allow past OpenDNS filters. On that machine I manually set the name servers, and created another rule to allow it to pass

iptables -t nat -I PREROUTING -i br0 -s -j ACCEPT

This worked well.

Today, I installed a transparent proxy (squid) on the router and added these rules:

iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_IP -p tcp --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT

This also works, however the address does not get routed through squid. How can I have (and maybe others in the future) by-pass the port 53 rules, but not the port 80 rules?

share|improve this question
up vote 0 down vote accepted

Simply update this rule to make it more specific and only apply to DNS.

remove - iptables -t nat -I PREROUTING -i br0 -s -j ACCEPT
add - iptables -t nat -I PREROUTING -i br0 -s -p all --dport 53 -j ACCEPT
share|improve this answer
I tried that, but it isn't working for some reason. I'll update when I figure it out. – SlimSCSI Sep 1 '11 at 17:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.