4

I have a router with dd-wrt. I have a firewall running to direct all traffic through an external proxy. It works great except that it also redirects local Ips and my proxy does not allow Ips, so I can not access my router Web administration.

The firewall I have running is:

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j DNAT --to 218.108.168.73:82 
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 443 -j DNAT --to 218.108.168.73:82

What can I add to this to access my router ip?

Daniel
  • 41
  • 1
  • 2
  • Please once modify rule as I mentioned in my answer, right now I don't have machine to test.. so please let me know if you face any issue – Rahul Patil Sep 13 '13 at 15:25

2 Answers2

2

You can use ! -s or -d to exclude some IP/Network

From man iptables 

[!] -s, --source address[/mask][,...]
     Source specification. Address can be either a network name, a hostname,  a
     network  IP address (with /mask), or a plain IP address. Hostnames will be
     resolved once only, before the rule is submitted to  the  kernel.   Please
     note  that  specifying any name to be resolved with a remote query such as
     DNS is a really bad idea.  The mask can be either  a  network  mask  or  a
     plain number, specifying the number of 1's at the left side of the network
     mask.  Thus, a mask of 24 is equivalent to 255.255.255.0.  A "!"  argument
     before  the  address  specification  inverts the sense of the address. The
     flag --src is an alias for this option.  Multiple addresses can be  speciâ
     fied,  but  this  will  expand to multiple rules (when adding with -A), or
     will cause multiple rules to be deleted (with -D).

[!] -d, --destination address[/mask][,...]
     Destination specification.  See the description of the  -s  (source)  flag
     for  a detailed description of the syntax.  The flag --dst is an alias for
     this option

So your rule should to exclude particular ip 

iptables -t nat -A PREROUTING -i br0 '!' -d IPAddrOfyourRouter/32 -p tcp --dport 80 -j DNAT --to 218.108.168.73:82
Rahul Patil
  • 24,281
  • 25
  • 80
  • 96
0

I've seen this request coming from multiple people.

Use case: I should be able to forward all traffic on a specific port to a specific IP.

Solution

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat  -F
iptables -t nat -A PREROUTING -p tcp --dport 5432 -j DNAT --to-destination 10.21.33.61:5432
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t nat -L -n

.

New use case: I should be able to forward all traffic on a specific port to a specific IP but exclude 1 IP.

Solution

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat  -F
iptables -t nat -A PREROUTING '!' -s 10.21.33.61/32 -p tcp --dport 5432 -j DNAT --to 10.21.33.61:5432
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t nat -L -n

Here:

  1. 10.21.33.61/32 is the IP we want to exclude from forwarding.
  2. 10.21.33.61:5432 is the IP:Port we want to forward traffic to
  3. 5432 is the port you want to forward traffic for.
  4. '!' -s is used for excluding the source.
utkarsh-devops
  • 101
  • 2