Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I try to explain my project. I have a server with 2 interfaces one has to offer a website and absolutely nothing else. The other interface will be used to control and manage this server. To the interface of the webserver will be attached a access point to get connected to this server.

The picture Internet ---> eth0 = SERVER |FIREWALL| WebServer = eth1 --> AP --> USER1, USER2, ...

I installed Apache2 and dnsmasq who is now offering DHCP to LAN. What I want to do is to redirect everything from eth1 to eth1 port 80. And block everything else. This is just for security.


---- SOLUTION ----

After searching a lot and with the guide of the first response, I get the solution. My problem was to make a captive portal and redirect everything to local ip.

Solution, quite easy. Setup dnsmasq and set this setting:



Block any kind of traffic and redirect it to local ip

# iptables -t nat -I PREROUTING -j DNAT -s -p tcp --to-destination
# iptables -t nat -I PREROUTING -j DNAT -s -p udp --to-destination
share|improve this question
Is DHCP 'absolutely nothing else'? What do you want to achieve? – Oliver May 29 '12 at 15:03
I will have Webserver offering a static website. The people connected to this wlan has to access to webserver but nothing else. – enedebe May 29 '12 at 15:28
Sounds like some kind of captive portal. – Oliver May 29 '12 at 15:33
More o less, yes. – enedebe May 29 '12 at 15:36
up vote 1 down vote accepted

You can achieve this as follows:

  1. Install a DNS server with a fake root zone, where you direct everything to your ip address (e.g. * IN A

  2. Install apache on

Of course, you will need to configure DHCP to hand out your fake DNS server's IP address to your clients. Also, make sure that server doesn't forward packets from eth1 to eth0 (i.e. switch off ip_forward).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.