I have set up a Personal hotspot using Hostapd. But this hotspot is not connected to the internet but I do have Apache installed on it. What I am trying to achieve is to redirect all the clients (that are connected to my hotspot) to my apache page when they visit another website. So basically redirect all traffic to my Apache page.

What I have tried is :

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination

But with this iptable the clients do not get redirected to my apache web page. But when i turn on internet sharing aswell with the hotspot then it does work. But i would like it to work without having to share a internet connection.

closed as off-topic by Iain, Ward, mdpc, MadHatter, kasperd Sep 9 '14 at 21:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Iain, Ward, mdpc, MadHatter, kasperd
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Ah, the overzealous strike again. – Marcin Kaminski Sep 11 '14 at 20:03

The redirection rule looks fine to me. I think the only difference between when you do and don't allow the wireless to access your Internet connection is that suddenly the DNS starts working.

I suspect the issue is that without being able to resolve hostnames, your wireless users:

  1. type www.google.com in their browser
  2. the resolver on their machine gives up after being unable to contact the DNS server received as part of their DHCP lease, because it is (most likely) external to your NAT which doesn't forward your client's packets to it.
  3. if they don't have the IP address to send the HTTP request to, they won't issue it
  4. no redirection takes place, since there's nothing to redirect.

Does that look like what's actually happening? If so, you can solve this in many ways:

  1. Even when you don't share your Internet connection, only allow forwarding your clients' requests to the DNS you give to them. Nothing else. The downside is that you open your resolved to be abused by tunnelling IP traffic by encapsulating it in DNS requests (by using iodine for instance)
  2. Move the DNS resolver to be in front of the NAT (directly accessible by your users). Byt that, I mean assign it an IP address that your users can access without having to go through the NAT. Doesn't bring much to the table and you'll still open the resolver to the tunnelling issue.
  3. Set up a bogus resolver whose address you'll give out as part of the DHCP lease and configure it to only give out the IP address of your web server. This is evil and you should think twice before doing this. The advantage is that you won't need the iptables rule and you won't need to forward any of the users' packets to the Internet to make this work.

Let me know if this works for you.

  • Hi thanks for your reply, this is indeed the case of what is happening but how do i move the DNS resolver in front of the NAT? – Junaid Gondel Sep 8 '14 at 14:11
  • Just updated my response. – Marcin Kaminski Sep 8 '14 at 17:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.