How can I redirect HTTP requests to my captive portal/webserver using iptables

Question

I'm working on a project where we need to use the RPi as a Wifi access point, which I got to work. I can get on the internet through the RPi and can also connect my Apache webserver (which should be the captive portal).

Since this is the beginning phase I don't have to check if user input is correct according to the DB. I only need that when I log onto my Wifi AP and I go to www.google.com for example, it first sends me to my webserver/captive portal to log in(which is not required yet), and send me to google again.

I've looked at the iptables and got down some basic commands. Such as blocking incoming connections, dropping them etc and experimenting with NAT. Also read the man iptables and iptables --help, the chains and the policies.

However there's not much to be found on the internet regarding my issue, since there are many tools you can use to easily set up an working captive portal, but the teachers want us to use iptables. I have no clue where to start, I'm just looking for some help so I can figure out the rest myself.

Edit, maybe to make it more clear I've tried both these commands so far:

 sudo iptables -t nat -A PREROUTING -p tcp -m multiport --dports 443,80 -j DNAT --to-destination 192.168.2.4:80


 iptables -t nat -A POSTROUTING -j MASQUERADE

On my iphone it still goes to google.com without redirecting.

Answer 1

I've solved it thanks to a classmate that showed me the only thing I didn't try.

sudo iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.4.0/24 --dport 80 -j DNAT --to-destination 192.168.2.4

sudo iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.4.0/24 --dport 443 -j DNAT --to-destination 192.168.2.4

The first IP adress entered is your subnet IP. This will send all traffic singed onto your Wifi AP to the destination IP (192.168.2.4) which is your raspberry pi/localhost (which you use to set up Apache HTTP webserver).

It probably won't work for HTTPS assuming I need SSL certificate on my website, which I got from my study.

You'll have to adjust the iptables with connection states etc. to configure when you can get sent onto the internet, but this is something you'll do once you got API set up.