IPTables DNAT rule to local web server doesn't work with localhost?
3
votes
2
answers
2342
views
I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80.
There are certain sites I'd like to block, but not by dropping the packet, but by redirecting them to a blocked.html page being served by a local web server.
I have two nics. The one on the internet side is bound to 10.0.2.15. If I do a DNAT rule to redirect traffic to my web server using the internet NIC, the page is returned. If i redirect to 127.0.0.1, it is not.
Why is that?
Here is my IPTables configuration:
# iptables -S
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N block-chain
-A PREROUTING -j block-chain
-A POSTROUTING -o eth1 -j MASQUERADE
# THIS WILL NOT RETURN THE PAGE TO THE CLIENT
-A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 127.0.0.1:80
# THIS WILL
-A block-chain -d 206.190.36.45/32 -p tcp -j DNAT --to-destination 10.0.2.15:80
-A block-chain -j RETURN
Asked by John
Jun 18, 2014, 02:20 PM
Last activity: Jun 22, 2025, 04:09 AM
Last activity: Jun 22, 2025, 04:09 AM