My router redirects all incoming traffic (interface eth0) to IP :

iptables -t NAT -A PREROUTING -i eth0 -p tcp --dport 80 --to-destination

When a client hits "", I'd like not to redirect him but let him access the www-online IP (Note: IP-Forwarding is ON).

Finally any IP but are catched and redirected to

What iptables rules shall I add ? Before or after the redirect-all one (see above) ?

Thank you.

__ EDIT __ Here is the script I run to make my rules:


# Enable Internet connection sharing,
echo "1" > /proc/sys/net/ipv4/ip_forward

#clear all rules (flush)
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X


$IPTABLES -t nat -A PREROUTING -i wlan0  -d -p tcp --dport 80 -j ACCEPT

#http (80)
$IPTABLES -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j DNAT --to-destination

echo "\nipforward: done. but Apple."
  • iptables -t NAT -A PREROUTING -s -p tcp --dport 80 --to-destination I tried. Before all rules. – ArchiT3K Jul 24 '15 at 11:26
  • But that seems strange ... I m a noob in it. In addition, the requests are not made by IP but by domain name... So my problem should rather to dynamically add domain solving in dnsmasq... for instance address=/patati/ – ArchiT3K Jul 24 '15 at 11:26
  • Why -s Shouldn't that be -d, since you want packets set TO that IP to be matched? – GregL Jul 24 '15 at 11:37
  • That should. Am a noob. What is -s for btw ? – ArchiT3K Jul 24 '15 at 11:38
  • Check the man page for iptables to find out. – GregL Jul 24 '15 at 11:39
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -d -j ACCEPT

before the rule you show above (ie, handle the exception, then the rule).

iptables doesn't do DNS (in any way that you want) so abandon any thoughts of layer-4 handling - it's strictly a layer 2/3 tool. If you find this doesn't work, we'll need to see all your rules to make any further comment, so edit the result of iptables -L -n -v ; iptables -t nat -L -n -v into your question.

  • thanks Mad, was reading a post of yours eleswhere ;) ""iptables doesn't do DNS (in any way that you want) "" Arfff... I m ttrying to dnsmasq the URL to I hope that URL--DNS-->> – ArchiT3K Jul 24 '15 at 11:39
  • Thanks Im on Mac, time to go on my Linux machine and I post that all... Done. Edit is made – ArchiT3K Jul 24 '15 at 11:41
  • Well it does not suit to my goal, thanks a lot anyway. The things work only if I bind domain and in dnsmasq. I have bet on iptables cause you can add a rule dynamically. I just hope I can add an address in dnsmasq dynamically, compromised. – ArchiT3K Jul 24 '15 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.