Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My goal is to be able to make a connection to one, and only one, website through a proxy. Everything else should be dropped.

I have been able to do this successfully without a proxy with this code:

./iptables -I INPUT 1 -i lo -j ACCEPT
./iptabels -A OUTPUT -p udp --dport 53 -j ACCEPT
./iptables -A OUTPUT -p tcp -d --dport 80 -j ACCEPT
./iptables -A INPUT -m conntrack --cstate ESTABLISHED,RELATED -j ACCEPT
./iptables -P INPUT DROP
./iptables -P OUTPUT DROP

How could I do the same thing except redirect the traffic to port 8080 somewhere? I've been trying to redirect in the PREROUTING chain in the nat table. I'm unsure if this is the proper place to do that tho.

Thanks for your help!

share|improve this question

migrated from Sep 8 '12 at 9:02

This question came from our site for professional and enthusiast programmers.

I think the webserver configuration is better place to do this. Please check the virtual hosts configuration of the Apache server:

Apache vhosts configuration:

Other servers have similar configuration. You can specify what websites (by URL) you want them to handle.

share|improve this answer

You don't need to drop the http traffic except the traffic destined to specific domain using iptables. You can redirect http traffic to your proxy using a rule like this:

iptables -t nat -A PREROUTING -p tcp --dport 80  -j DNAT --to-destination proxy_ip:8080

You need to have a running proxy server which supports transparent proxying and listening on port 8080. You can then configure your proxy to allow/deny whatever you want like domains/URLs, etc..

Please, note that using domain names in iptables rule is not a good idea as the changes in name-IP mapping will not be seen by iptables after entering the rules.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.