☰

如何将所有 HTTP 请求重定向到本地 Web 服务器

tag-icon • tag-icon iptables
如何将所有 HTTP 请求重定向到本地 Web 服务器

假设我们没有互联网连接，如何将所有 HTTP 请求重定向到本地 Web 服务器

示例

  • Web 服务器@IP 192.168.1.1，运行 apache
  • @IP 192.168.1.X 的客户端向 XXXX:80-443 发出 HTTP 请求，并且始终没有可用的互联网连接，因此所有这些流量应直接重定向到 192.168.1.1:80

我需要用 iptables 来做到这一点，谢谢你们的帮助:)

答案1

这是一个例子取自http://www.andybev.com/index.php/Using_iptables_and_PHP_to_create_a_captive_portal。这正是你想要的：

IPTABLES=/sbin/iptables

# Create internet chain
# This is used to authenticate users who have already signed up
$IPTABLES -N internet -t mangle

# First send all traffic via newly created internet chain
# At the prerouting NAT stage this will DNAT them to the local
# webserver for them to signup if they aren't authorised
# Packets for unauthorised users are marked for dropping later
$IPTABLES -t mangle -A PREROUTING -j internet

$IPTABLES -t mangle -A internet -j MARK --set-mark 99

# Redirects web requests from Unauthorised users to internet webserver
$IPTABLES -t nat -A PREROUTING -m mark --mark 99 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1

# Now that we've got to the forward filter, drop all packets
# marked 99 - these are unknown users. We can't drop them earlier
# as there's no filter table
$IPTABLES -t filter -A FORWARD -m mark --mark 99 -j DROP

# Do the same for the INPUT chain to stop people accessing the web through Squid
$IPTABLES -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -t filter -A INPUT -p udp --dport 53 -j ACCEPT
$IPTABLES -t filter -A INPUT -m mark --mark 99 -j DROP

相关内容