1

I am tryng to redirect all web traffic to a computer using:

iptables -t nat -A PREROUTING -p tcp  –destination-port 80 -j REDIRECT –to-port 1000

It works but I would like to add a rule in order to not redirect the traffic for a specific destination ip (ex: facebook.com)

Could not find on google. Thank in advance !

MadHatter
  • 79,770
  • 20
  • 184
  • 232
Thomas Sxt
  • 13
  • 4

1 Answers1

1

I note that the example destination IP you give is not, in fact, an IP address (which is what iptables deals in) but a fully-qualified domain name. However, let's assume you really had quoted an IP address, and let's assume it was 198.51.100.1 (in line with our advice on example IP addresses).

With only one address to exempt, you can add it to the rule as an explicit exemption:

iptables -t nat -A PREROUTING -p tcp --dport 80 \! -d 198.51.100.1 -j REDIRECT --to-port 1000

Note the use of the backslash to protect the negation (!) from the shell. If you had more addresses to exempt, it's simpler to write explicit rules that match those addresses and finish processing with a harmless dispositive target, then leave a catch-all rule at the end to deal with everything else:

iptables -t nat -A PREROUTING -p tcp --dport 80 -d 192.0.2.0/24 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -d 198.51.100.0/24 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -d 203.0.113.0/24 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 1000

Note that, as ever, order is important in iptables rules. Where these come in your chain is important, and you need to have a care to get it right.

Edit: you ask what will happen to packets that match the rules with ACCEPT targets, ie the exempted packets. Once they match ACCEPT, they will fall out of the PREROUTING nat chain, and no further processing will happen to them in that chain. Their eventual fate will be determined by rules and policies in the other chains they will then pass through.

Community
  • 1
MadHatter
  • 79,770
  • 20
  • 184
  • 232
  • 1
    This is an intersting read https://www.ringingliberty.com/2014/07/12/matching-autonomous-system-numbers-in-iptables/ – user9517 Jan 31 '17 at 14:55
  • Thanks a lot for your help i gonna try that. When I put those rules to don't redirect some traffic how the packet will behave on my network? It will go straight from my gateway to the target ? – Thomas Sxt Feb 01 '17 at 08:35
  • @ThomasSxt see edit above. Please note that local etiquette requests that you accept (by clicking the tick outline next to it) an answer to your question that you're happy with, once such appears. My apologies if you already know that. – MadHatter Feb 01 '17 at 08:49