Hi all,
Requirement is all packets , on g/k is be redirected to 8080 portal port ,
at any Instance this rule excludes the mac specified,by adding iprule to accept packets from specified mac,

Ex:
1 . /sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT

2 . /sbin/iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to 8080

3 . /sbin/iptables -t nat -A PREROUTING -p tcp -m mac --mac-source 00:19:5B:6C:12:21 -j ACCEPT

iptables -t nat -L --lists

Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere redir ports 8080
ACCEPT tcp -- anywhere anywhere MAC 00:19:5B:6C:12:21

Problem is it always considers the first rule: and redirects, how can we make the redirection rule low priority, and any ACCEPTS to be checked at beginning.

saw usage of -j MARK --setmark #priorityno .. could this be adapted here?


Lastly for allowing ssh from remote machine, used the below command
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT


looking for your suggestions.Thanks in advance

You can put the statements in the reverse sequence, that is, first the ACCEPT, then the REDIRECT.

IPTables executes the rules in the order they are given. As soon as a rule is matched, the packet is processed according to the rule, and then the target is terminating (ACCEPT, REDIRECT) it is over and done.

jlinkels

thanks, Initially is to be redirected . thing is its decided at later stage after authentication to allow user(with macid xx..xx). to acess without redirection,
any ways to make the current rule appear first or
make the former rule appear last(low priority)

did execute , but the first rule appears to take priority

1./sbin/iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to 8080

2. /sbin/iptables -t nat -A PREROUTING -p tcp -m mac --mac-source 00:19:5B:6C:12:21 -j ACCEPT


/sbin/iptables -t nat -L

Chain PREROUTING (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere redir ports 8080
ACCEPT tcp -- anywhere anywhere MAC 00:19:5B:6C:12:21

So this what you want:


Use -I instead of -A, so the rule is not Appended but Inserted (at the head of the chain)

When the max address is not matched, the next rule is evaluated, then the next etc. and the very last rule is REDIRECT to 8080

Is that what you mean?

jlinkels

thanku jlinkels ,for correcting -A to -I and yes thats what i precisely mean.

m refering nat table for redirecting packets,

* Except to packets destined for port 22(ssh)

whether this iprule to accept port 22 is to be inserted in filter
or nat table? please do know hw its gng to affect by inserting rule in filter table(1) or nat table(2)
1. /sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Or
2. /sbin/iptables -t nat -I PREROUTING -p tcp --dport 22 -j ACCEPT


One Last ..
i look to reject all packets (other than port 22/80, ) hence appended at last.. this rule is showing invalid.. whats wrong in rule below

/sbin/iptables -t nat -A PREROUTING -p tcp -j REJECT

thanks all