I try to explain my project. I have a server with 2 interfaces one has to offer a website and absolutely nothing else. The other interface will be used to control and manage this server. To the interface of the webserver will be attached a access point to get connected to this server.

The picture Internet ---> eth0 = SERVER |FIREWALL| WebServer = eth1 --> AP --> USER1, USER2, ...

I installed Apache2 and dnsmasq who is now offering DHCP to LAN. What I want to do is to redirect everything from eth1 to eth1 port 80. And block everything else. This is just for security.


---- SOLUTION ----

After searching a lot and with the guide of the first response, I get the solution. My problem was to make a captive portal and redirect everything to local ip.

Solution, quite easy. Setup dnsmasq and set this setting:



Block any kind of traffic and redirect it to local ip

# iptables -t nat -I PREROUTING -j DNAT -s -p tcp --to-destination
# iptables -t nat -I PREROUTING -j DNAT -s -p udp --to-destination
  • Is DHCP 'absolutely nothing else'? What do you want to achieve? – Oliver May 29 '12 at 15:03
  • I will have Webserver offering a static website. The people connected to this wlan has to access to webserver but nothing else. – enedebe May 29 '12 at 15:28
  • Sounds like some kind of captive portal. – Oliver May 29 '12 at 15:33
  • More o less, yes. – enedebe May 29 '12 at 15:36

You can achieve this as follows:

  1. Install a DNS server with a fake root zone, where you direct everything to your ip address (e.g. * IN A

  2. Install apache on

Of course, you will need to configure DHCP to hand out your fake DNS server's IP address to your clients. Also, make sure that server doesn't forward packets from eth1 to eth0 (i.e. switch off ip_forward).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.