I have a intranet webserver. I want all traffic to be redirected to that web-server, the web-server is also a recursive dns server. I have another server acting as a router also. At first I tried to use the webserver as a router and set up these rules:
iptables -t nat -A PREROUTING -p udp --dport 53 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
It doesnt deny anything, just allows dns and re-routes web traffic to itself. Now all clients using that web-server as a gateway will only get that web-servers web-page displayed. Bt I didnt want the web-server to do routing. I wanted my network server and router to do that. So I set the clients to use my router as a default gateway and added these rules to it:
#Ping is oing to be allowed
iptables -A FORWARD -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
#DNS is going to be allowed
iptables -t nat -A PREROUTING -p udp --dport 53 -j ACCEPT
#Clients with these IP-addresses are gong to be allowed(changing to MAC later):
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.100 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.101 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.102 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.205 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s 192.168.1.206 -j ACCEPT
#MSN is allowed
iptables -t nat -A PREROUTING -p tcp --dport 1873 -j ACCEPT
#All web traffic should be redirected
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.1.100:80
#Later I will add rules to denying traffic.
The rules that handle DNAT are the same as on the web-server, when it was a router. But this doesnt work. The clients never get a reply from any page, but they are supposed to get a reply from my web-server.
