The redirection rule looks fine to me. I think the only difference between when you do and don't allow the wireless to access your Internet connection is that suddenly the DNS starts working.
I suspect the issue is that without being able to resolve hostnames, your wireless users:
- type www.google.com in their browser
- the resolver on their machine gives up after being unable to contact the DNS server received as part of their DHCP lease, because it is (most likely) external to your NAT which doesn't forward your client's packets to it.
- if they don't have the IP address to send the HTTP request to, they won't issue it
- no redirection takes place, since there's nothing to redirect.
Does that look like what's actually happening? If so, you can solve this in many ways:
- Even when you don't share your Internet connection, only allow forwarding your clients' requests to the DNS you give to them. Nothing else. The downside is that you open your resolved to be abused by tunnelling IP traffic by encapsulating it in DNS requests (by using iodine for instance)
- Move the DNS resolver to be in front of the NAT (directly accessible by your users). Byt that, I mean assign it an IP address that your users can access without having to go through the NAT. Doesn't bring much to the table and you'll still open the resolver to the tunnelling issue.
- Set up a bogus resolver whose address you'll give out as part of the DHCP lease and configure it to only give out the IP address of your web server. This is evil and you should think twice before doing this. The advantage is that you won't need the iptables rule and you won't need to forward any of the users' packets to the Internet to make this work.
Let me know if this works for you.