0

I'm using iptables on my router to redirect all web traffic to my page.

But i don't know how to except my mac address list.

I did command like this

iptables -t nat -A PREROUTING -m mac ! --mac-source xx-xx-xx-xx-xx-xx -p tcp --dport 80  -j DNAT --to 127.0.0.1:8080 (Host A)
iptables -t nat -A PREROUTING -m mac ! --mac-source xx-xx-xx-xx-xx-xx -p tcp --dport 80  -j DNAT --to 127.0.0.1:8080 (Host B)

But it just execute command for host A. It means Host A can access web normally but Host B still got redirect.

How can i got access normally for both mac address?

1

Your are getting this problem as your are using !. Say, one request comes and if mac address of coming host in that is other than mac address of host A, it will be redirected. And hence it is also being redirected for host B. And your second rule will never be executed.

So the solution for, how to except my mac address list?

  1. Jump to one custom chain
iptables -t nat -N accept_my_mac_set
iptables -t nat -A PREROUTING -j accept_my_mac_set
iptables -t nat -A PREROUTING -j DNAT --to 127.0.0.1:8080
  1. Accept your mac set in accept_my mac_set otherwise return from accept_my_mac_set chain and redirect all traffic
iptables -A accept_my_mac_set -m mac --mac-source xx-xx-xx-xx-xx-xx, xx-xx-xx-xx-xx-xx -p tcp --dport 80 -j ACCEPT  
iptables -A accept_my_mac_set -j RETURN
  • I got error when execute your second command. iptables v1.3.7: Couldn't find target `accept_my_mac_set' – Trần Minh Phương Feb 18 '15 at 10:22
  • For custom chain creation use: iptables -t nat -N accept_my_mac_set – Hitesh Menghani Feb 18 '15 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.