Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux box behaving like a router that handles two network interfaces: eth0 for internet and eth1 for LAN.

I set up iptables in order to redirect all the web traffic coming by the LAN into a local apache, listening on port 80 as well, using these rules:

sudo iptables -t mangle -N internet
sudo iptables -t mangle -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j internet
sudo iptables -t mangle -A internet -j MARK --set-mark 99
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp -m mark --mark 99 -m tcp --dport 80 -j DNAT --to-destination $BOX_IP

Now I need to add an exception to this behaviour for some known mac addresses, in order to redirect their web traffic not to the apache but to a squid proxy, that's listening on port 3128.

I managed to just remove the redirection and let the web request go to the requested host appending this other rule:

sudo iptables -t mangle -I internet 1 -m mac --mac-source $MAC_ADDRESS -j RETURN

but what I want is that the web traffic is natted into $BOX_IP:3128. What's the best way to do that?

share|improve this question

Why do you repeat all those filter criteria in the --mark 99 line? you mark a packet, that's it. If more criteria appear then you should change the marking but not check for more than the mark. BTW the chain name internet seems rather suboptimal to me.


if iptables -L apache -n &>/dev/null; then
  iptables -t mangle -F apache
  iptables -t mangle -N apache
iptables -t mangle -A apache -j MARK --set-mark 99
# finish the handling of this packet in this table
iptables -t mangle -A apache -j ACCEPT

if iptables -L squid -n &>/dev/null; then
  iptables -t mangle -F squid
  iptables -t mangle -N squid
iptables -t mangle -A squid -j MARK --set-mark 98
# finish the handling of this packet in this table
iptables -t mangle -A squid -j ACCEPT

if iptables -L proxy_mac_check -n &>/dev/null; then
  iptables -t mangle -F proxy_mac_check
  iptables -t mangle -N proxy_mac_check
for MAC_ADDRES in 11:22:33:44:55:66 11:22:33:44:55:67; do
  iptables -t mangle -A proxy_mac_check -m mac --mac-source $MAC_ADDRES -j squid
iptables -t mangle -A proxy_mac_check -j apache

iptables -t mangle -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j proxy_mac_check

iptables -t nat -A PREROUTING -m mark --mark 99 -j DNAT --to-destination $BOX_IP
iptables -t nat -A PREROUTING -m mark --mark 98 -j DNAT --to-destination $BOX_IP:3128
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.