Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Radius server doing Mac Auth on VLANs. If the MAC address isn't in the allowed table, the user is put into a separate VLAN. What I want to do on that separate VLAN, is have my Debian server giving out IP's via a DHCP server.

What I need help with is the following: how do I use iptables to redirect all access from the clients to my webpage? I want to serve the webpage so they can register their device. I have a DHCP setup working as well as Apache, I just can't seem to get iptables to redirect this traffic.

share|improve this question

I believe you are looking for Destination NAT target in the PREROUTING chain. This redirects any request coming across the interface to the desired destination. (Your registration server.)

/sbin/iptables -t nat -A PREROUTING -s [source network/mask] -p tcp --dport 80 -j DNAT --to-destination [your webserver]

This is described in detail on the famous site Upside-Down-Ternet where Wi-Fi leeches are redirected to kittenwar.

share|improve this answer
following that i get a no chains error, which is fine, easy to fix, i added -t nat before the -A...still doesn't work, is there anything else I need to do in iptables for this to work? – John Feb 29 '12 at 20:30
Shouldn't be any thing, but I can't test it at the moment to verify. I've used the instructions in the link before and compared to the same in the book, "Linux iptables Pocket Reference." Rather than matching on the source network, try -i eth0 (or whatever your interface is.) – Aaron Copley Feb 29 '12 at 20:36
Also, to eliminate any other source of trouble, your registration server is listening on port 80, right? Could I see the whole rule that you have in place? And it's not listed after a drop/reject rule, right? – Aaron Copley Feb 29 '12 at 20:46
Yes webserver is listening on 80, on the client I can go to the destination address in iptables and it works. # Generated by iptables-save v1.4.8 on Wed Feb 29 15:50:22 2012 *nat :PREROUTING ACCEPT [1:33] :POSTROUTING ACCEPT [1:132] :OUTPUT ACCEPT [1:132] -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination COMMIT # Completed on Wed Feb 29 15:50:22 2012 – John Feb 29 '12 at 20:50
And this host is your gateway on that VLAN? I can't imagine why it isn't working. – Aaron Copley Feb 29 '12 at 20:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.