Tricky iptables question

[Maude]

Hello,

I have these lines in my firewall script that permits some ip's to get to the website but denies others based on countries and such (ipset sets)...

in the nat table: 
-A PREROUTING -d xxx.15.207.xxx/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.25:80

in the filter table:
-A FORWARD -m conntrack --ctstate DNAT -m set --match-set BlockedCountries src -j DROP

Would using matchset DIRECTLY on the PREROUTING chain work ?

It would give something like this:

-A PREROUTING -d xxx.15.207.xxx/32 -p tcp -m tcp --dport 80 -m set --match-set BlockedCountries src -j DNAT --to-destination www,xxx,yyy,zzz:80
-A PREROUTING -d xxx.15.207.xxx/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.25:80

 

[Maude]

I just answered my own question ! I works !

iptables -t nat -I PREROUTING -d `nvram get wan0_ipaddr`/32 -p tcp -m tcp --dport 80 -m set --match-set Whitelist src -j DNAT  --to-destination 184.150.153.221:80

With this, I get redirected to Google homepage because I'm in the Whitelist !

YAY Maude !