I have a Radius server doing Mac Auth on VLANs. If the MAC address isn't in the allowed table, the user is put into a separate VLAN. What I want to do on that separate VLAN, is have my Debian server giving out IP's via a DHCP server.

What I need help with is the following: how do I use iptables to redirect all access from the clients to my webpage? I want to serve the webpage so they can register their device. I have a DHCP setup working as well as Apache, I just can't seem to get iptables to redirect this traffic.


1 Answer 1


I believe you are looking for Destination NAT target in the PREROUTING chain. This redirects any request coming across the interface to the desired destination. (Your registration server.)

/sbin/iptables -t nat -A PREROUTING -s [source network/mask] -p tcp --dport 80 -j DNAT --to-destination [your webserver]

This is described in detail on the famous site Upside-Down-Ternet where Wi-Fi leeches are redirected to kittenwar. http://www.ex-parrot.com/~pete/upside-down-ternet.html

  • following that i get a no chains error, which is fine, easy to fix, i added -t nat before the -A...still doesn't work, is there anything else I need to do in iptables for this to work?
    – John
    Feb 29, 2012 at 20:30
  • Shouldn't be any thing, but I can't test it at the moment to verify. I've used the instructions in the link before and compared to the same in the book, "Linux iptables Pocket Reference." Rather than matching on the source network, try -i eth0 (or whatever your interface is.) Feb 29, 2012 at 20:36
  • Also, to eliminate any other source of trouble, your registration server is listening on port 80, right? Could I see the whole rule that you have in place? And it's not listed after a drop/reject rule, right? Feb 29, 2012 at 20:46
  • Yes webserver is listening on 80, on the client I can go to the destination address in iptables and it works. # Generated by iptables-save v1.4.8 on Wed Feb 29 15:50:22 2012 *nat :PREROUTING ACCEPT [1:33] :POSTROUTING ACCEPT [1:132] :OUTPUT ACCEPT [1:132] -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination COMMIT # Completed on Wed Feb 29 15:50:22 2012
    – John
    Feb 29, 2012 at 20:50
  • And this host is your gateway on that VLAN? I can't imagine why it isn't working. Feb 29, 2012 at 20:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .