Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to iptables and would like to reroute all outbound HTTP traffic on my router from port 80 to port 53. Is this possible?

Thanks in advance for any help.



I ran

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 53 -j REDIRECT --to-port 5300

That produced

iptables v1.4.6: unknown option `--to-ports'
Try `iptables -h' or 'iptables --help' for more information. 

I then ran

opkg install iptables-mod-nat-extra

That produced

opkg_install_cmd: Cannot install package iptables-mod-nat-extra

Thanks for help with this.


share|improve this question

closed as off topic by Michael Hampton, gWaldo, MDMarra, Wesley, MadHatter May 23 '13 at 21:02

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Is this on openwrt by any chance? If you're getting that message then the kernel's not compatible with redirecting via iptables - at least that route. – Nathan C May 23 '13 at 14:55
Please don't ask us how to circumvent network security measures. After all, we are the people who implement those security measures! – Michael Hampton May 23 '13 at 16:20
What are you hoping to achieve by doing this? – MDMarra May 23 '13 at 16:22

From your question it isn't clear what you want to do (or even that you know what you want to do), so here's a few pointers:

  • -t nat -- gets you to the NAT table, this is where you want to be for what it sounds like you want to do
  • -A POSTROUTING - the POSTROUTING table is for AFTER the routing decision has been made. Usually means the traffic is on its way out. You can change SOURCE addresses, but not DESTINATION addresses here.
  • -A PREROUTING - the PREROUTING table is for BEFORE the routing decision has been made. If you want to change where the packet goes, then do it here. It sounds like this is what you want.
  • -A OUTPUT - the OUTPUT table is for outbound packets that originated (or were otherwise modified) by a local process, and specifically NOT for packets that your server is handling in the role of a router/switch/gateway. This is a convenient place to put rules for traffic that your server is generating on its own.
  • -j REDIRECT - doesn't do what you think it does. Probably not what you want.
  • -j SNAT - Source Network Address Translation. This is for changing the source address or source port. If you want to change where the packet came from, then use this target
  • -j DNAT - Destination Network Address Translation. This is for changing the destination address or port. If you want to change where the packet goes, then use this target.

So, to modify traffic passing through a router destined for port 80 and change that destination to port 53, you can use this:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to :53

This will do exactly what you asked for. Specifically, it will make all websites unreachable.

share|improve this answer

Since you seem to be asking about traffic originating at the router itself, you should not be using the PREROUTING chain but the OUTPUT chain. Also, if the traffic is originating at the router itself, it is a much better option to change the configuration of the processes initiating the connection to simply use a different destination port.

If this is not working for you for whatever reason, you can use the DNAT target like

iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to :53

note though that since the destination servers are not expecting HTTP requests at port 53, you likely would not get any meaningful responses unless you revert the translation at some point behind the captive portal. You might consider tunneling through to a host under your control outside the restricted network (e.g. using OpenVPN) and simply route the requests through the tunnel instead.

share|improve this answer

This would work:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 53

Further instructions/reference:

share|improve this answer
Thanks, but when I ran that it produced the above results. – Eric May 23 '13 at 15:03
I commented on the question. Looks like the router's kernel doesn't support redirects with iptables. You could put squid or similar in front of your router to redirect. On that note, why do you need to redirect? – Nathan C May 23 '13 at 15:16
Ok, i'll look at implementing squid. I'm using a OpenWRT router without a gui and would like to connect to connect its wan port to a network with an HTTP captive web portal capturing traffic from port 80. I am looking to redirect traffic to an open port in order to bypass that portal since I can not authenticate to it due to not having a browser. Thanks for your help – Eric May 23 '13 at 15:27
Note that "REDIRECT" is intended to redirect to local ports - this seems not to be what the question is about. – the-wabbit May 23 '13 at 16:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.