Sample Header Ad - 728x90

IPTables DNAT rule to local web server doesn't work with localhost?

3 votes
2 answers
2342 views
I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80. There are certain sites I'd like to block, but not by dropping the packet, but by redirecting them to a blocked.html page being served by a local web server. I have two nics. The one on the internet side is bound to 10.0.2.15. If I do a DNAT rule to redirect traffic to my web server using the internet NIC, the page is returned. If i redirect to 127.0.0.1, it is not. Why is that? Here is my IPTables configuration: # iptables -S -P INPUT DROP -P FORWARD ACCEPT -P OUTPUT DROP -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --sport 80 -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT -A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT # iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -N block-chain -A PREROUTING -j block-chain -A POSTROUTING -o eth1 -j MASQUERADE # THIS WILL NOT RETURN THE PAGE TO THE CLIENT -A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 127.0.0.1:80 # THIS WILL -A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 10.0.2.15:80 -A block-chain -j RETURN
Asked by John
Jun 18, 2014, 02:20 PM
Last activity: Jun 22, 2025, 04:09 AM