I'm using iptables on my router to redirect all web traffic to my page.

But i don't know how to except my mac address list.

I did command like this

iptables -t nat -A PREROUTING -m mac ! --mac-source xx-xx-xx-xx-xx-xx -p tcp --dport 80  -j DNAT --to (Host A)
iptables -t nat -A PREROUTING -m mac ! --mac-source xx-xx-xx-xx-xx-xx -p tcp --dport 80  -j DNAT --to (Host B)

But it just execute command for host A. It means Host A can access web normally but Host B still got redirect.

How can i got access normally for both mac address?

1 Answer 1


Your are getting this problem as your are using !. Say, one request comes and if mac address of coming host in that is other than mac address of host A, it will be redirected. And hence it is also being redirected for host B. And your second rule will never be executed.

So the solution for, how to except my mac address list?

  1. Jump to one custom chain
iptables -t nat -N accept_my_mac_set
iptables -t nat -A PREROUTING -j accept_my_mac_set
iptables -t nat -A PREROUTING -j DNAT --to
  1. Accept your mac set in accept_my mac_set otherwise return from accept_my_mac_set chain and redirect all traffic
iptables -A accept_my_mac_set -m mac --mac-source xx-xx-xx-xx-xx-xx, xx-xx-xx-xx-xx-xx -p tcp --dport 80 -j ACCEPT  
iptables -A accept_my_mac_set -j RETURN
  • I got error when execute your second command. iptables v1.3.7: Couldn't find target `accept_my_mac_set' Feb 18, 2015 at 10:22
  • For custom chain creation use: iptables -t nat -N accept_my_mac_set Feb 18, 2015 at 11:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .