Redirect Outbound HTTP to port 53 iptables

Question

I am new to iptables and would like to reroute all outbound HTTP traffic on my router from port 80 to port 53. Is this possible?

Thanks in advance for any help.

Eric

*Edit

I ran

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 53 -j REDIRECT --to-port 5300

That produced

iptables v1.4.6: unknown option `--to-ports'
Try `iptables -h' or 'iptables --help' for more information. 

I then ran

opkg install iptables-mod-nat-extra

That produced

opkg_install_cmd: Cannot install package iptables-mod-nat-extra

Thanks for help with this.

Eric

Solution 1

From your question it isn't clear what you want to do (or even that you know what you want to do), so here's a few pointers:

• -t nat -- gets you to the NAT table, this is where you want to be for what it sounds like you want to do
• -A POSTROUTING - the POSTROUTING table is for AFTER the routing decision has been made. Usually means the traffic is on its way out. You can change SOURCE addresses, but not DESTINATION addresses here.
• -A PREROUTING - the PREROUTING table is for BEFORE the routing decision has been made. If you want to change where the packet goes, then do it here. It sounds like this is what you want.
• -A OUTPUT - the OUTPUT table is for outbound packets that originated (or were otherwise modified) by a local process, and specifically NOT for packets that your server is handling in the role of a router/switch/gateway. This is a convenient place to put rules for traffic that your server is generating on its own.
• -j REDIRECT - doesn't do what you think it does. Probably not what you want.
• -j SNAT - Source Network Address Translation. This is for changing the source address or source port. If you want to change where the packet came from, then use this target
• -j DNAT - Destination Network Address Translation. This is for changing the destination address or port. If you want to change where the packet goes, then use this target.

So, to modify traffic passing through a router destined for port 80 and change that destination to port 53, you can use this:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to :53

This will do exactly what you asked for. Specifically, it will make all websites unreachable.

Solution 2

Since you seem to be asking about traffic originating at the router itself, you should not be using the PREROUTING chain but the OUTPUT chain. Also, if the traffic is originating at the router itself, it is a much better option to change the configuration of the processes initiating the connection to simply use a different destination port.

If this is not working for you for whatever reason, you can use the DNAT target like

iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to :53

note though that since the destination servers are not expecting HTTP requests at port 53, you likely would not get any meaningful responses unless you revert the translation at some point behind the captive portal. You might consider tunneling through to a host under your control outside the restricted network (e.g. using OpenVPN) and simply route the requests through the tunnel instead.

Comments

[Nathan C]

Is this on openwrt by any chance? If you're getting that message then the kernel's not compatible with redirecting via iptables - at least that route.

[Michael Hampton]

Please don't ask us how to circumvent network security measures. After all, we are the people who implement those security measures!

[MDMarra]

What are you hoping to achieve by doing this?

[Eric]

Thanks, but when I ran that it produced the above results.

[Nathan C]

I commented on the question. Looks like the router's kernel doesn't support redirects with iptables. You could put squid or similar in front of your router to redirect. On that note, why do you need to redirect?

[Eric]

Ok, i'll look at implementing squid. I'm using a OpenWRT router without a gui and would like to connect to connect its wan port to a network with an HTTP captive web portal capturing traffic from port 80. I am looking to redirect traffic to an open port in order to bypass that portal since I can not authenticate to it due to not having a browser. Thanks for your help

[the-wabbit]

Note that "REDIRECT" is intended to redirect to local ports - this seems not to be what the question is about.

[est]

Hi, if I want to DNAT passing-thro traffic on my router, can I use -A OUTPUT in some way?