I'm working on a project where we need to use the RPi as a Wifi access point, which I got to work. I can get on the internet through the RPi and can also connect my Apache webserver (which should be the captive portal).

Since this is the beginning phase I don't have to check if user input is correct according to the DB. I only need that when I log onto my Wifi AP and I go to www.google.com for example, it first sends me to my webserver/captive portal to log in(which is not required yet), and send me to google again.

I've looked at the iptables and got down some basic commands. Such as blocking incoming connections, dropping them etc and experimenting with NAT. Also read the man iptables and iptables --help, the chains and the policies.

However there's not much to be found on the internet regarding my issue, since there are many tools you can use to easily set up an working captive portal, but the teachers want us to use iptables. I have no clue where to start, I'm just looking for some help so I can figure out the rest myself.

Edit, maybe to make it more clear I've tried both these commands so far:

 sudo iptables -t nat -A PREROUTING -p tcp -m multiport --dports 443,80 -j DNAT --to-destination

 iptables -t nat -A POSTROUTING -j MASQUERADE

On my iphone it still goes to google.com without redirecting.

  • Have you enabled IP forwarding? Do net.ipv4.ip_forward or /proc/sys/net/ipv4/ip_forward sound familiar? Commented Nov 27, 2018 at 8:09
  • Yes, I'll have to check again just to be sure but I'm pretty sure I've enabled it to =1.
    – N3ur0
    Commented Nov 27, 2018 at 8:16
  • I've turned it to =1, no luck. Is redirecting to another webpage even possible through iptables, or is it to redirect traffic?
    – N3ur0
    Commented Nov 28, 2018 at 14:36

1 Answer 1


I've solved it thanks to a classmate that showed me the only thing I didn't try.

sudo iptables -t nat -A PREROUTING -p tcp -m tcp -s --dport 80 -j DNAT --to-destination

sudo iptables -t nat -A PREROUTING -p tcp -m tcp -s --dport 443 -j DNAT --to-destination

The first IP adress entered is your subnet IP. This will send all traffic singed onto your Wifi AP to the destination IP ( which is your raspberry pi/localhost (which you use to set up Apache HTTP webserver).

It probably won't work for HTTPS assuming I need SSL certificate on my website, which I got from my study.

You'll have to adjust the iptables with connection states etc. to configure when you can get sent onto the internet, but this is something you'll do once you got API set up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.