force specific destination to proxy

[bilboSNB]

I would like to force transparently web traffic destined only for a certain ip address eg 1.1.1.1 to go through the proxy 192.168.0.1 port 8080. Looking at the wiki this can be done with ip tables, what would the appropriate rule be, if not this what?

The proxy is running on the router.

iptables -I PREROUTING -t nat -p udp -s `nvram get lan_ipaddr`/`nvram get lan_netmask` ! -d `nvram get lan_ipaddr`/`nvram get lan_netmask` --d 1.1.1.1 --dport 80 -j DNAT --to-destination `nvram get lan_ipaddr`:8080

thanks

 

[bilboSNB]

Would this do it?

iptables -t nat -A PREROUTING --d 1.1.1.1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080

 

[bilboSNB]

If I put this in scripts will it work its a ddwrt, script?


#!/bin/sh
PROXY_IP=192.168.0.1
PROXY_PORT=8080
LAN_IP=`nvram get lan_ipaddr`
LAN_NET=$LAN_IP/`nvram get lan_netmask`





iptables -t nat -A PREROUTING -i br0 -s $LAN_NET -d $LAN_NET -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s ! $PROXY_IP -p tcp -d 1.1.1.1 --dport 80 -j DNAT --to $PROXY_IP:$PROXY_PORT
iptables -t nat -I POSTROUTING -o br0 -s $LAN_NET -d $PROXY_IP -p tcp -j SNAT --to $LAN_IP
iptables -I FORWARD -i br0 -o br0 -s $LAN_NET -d $PROXY_IP -p tcp --dport $PROXY_PORT -j ACCEPT

 

[bilboSNB]

I've settled for this, seems to do what I want:



iptables -I PREROUTING -t nat -p udp -s `nvram get lan_ipaddr`/`nvram get lan_netmask` ! -d `nvram get lan_ipaddr`/`nvram get lan_netmask` --dport 53 -j DNAT --to-destination `nvram get lan_ipaddr`
iptables -t nat -A PREROUTING -i br0 -s `nvram get lan_ipaddr`/`nvram get lan_netmask` -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i br0 -s ! 192.168.0.1 -p tcp -d 216.239.32.20 --dport 80 -j DNAT --to 192.168.0.1:8080
iptables -t nat -A PREROUTING -i br0 -s ! 192.168.0.1 -p tcp -d 204.79.197.200 --dport 80 -j DNAT --to 192.168.0.1:8080
iptables -t nat -I POSTROUTING -o br0 -s `nvram get lan_ipaddr`/`nvram get lan_netmask` -d 192.168.0.1 -p tcp -j SNAT --to `nvram get lan_ipaddr`
iptables -I FORWARD -i br0 -o br0 -s `nvram get lan_ipaddr`/`nvram get lan_netmask` -d 192.168.0.1 -p tcp --dport 8080 -j ACCEPT