I have a linux box behaving like a router that handles two network interfaces: eth0 for internet and eth1 for LAN.
I set up iptables in order to redirect all the web traffic coming by the LAN into a local apache, listening on port 80 as well, using these rules:
sudo iptables -t mangle -N internet sudo iptables -t mangle -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j internet sudo iptables -t mangle -A internet -j MARK --set-mark 99 sudo iptables -t nat -A PREROUTING -i eth1 -p tcp -m mark --mark 99 -m tcp --dport 80 -j DNAT --to-destination $BOX_IP
Now I need to add an exception to this behaviour for some known mac addresses, in order to redirect their web traffic not to the apache but to a squid proxy, that's listening on port 3128.
I managed to just remove the redirection and let the web request go to the requested host appending this other rule:
sudo iptables -t mangle -I internet 1 -m mac --mac-source $MAC_ADDRESS -j RETURN
but what I want is that the web traffic is natted into
What's the best way to do that?