how do I forward *only* http proxy across vlans?

Question

My router has two bridges, br0 and br1. I'm sharing wifi access, and the guest subnet will be 192.168.2.x. The home subnet will be 192.168.1.x.

I want all traffic destined for port 80 from the guest net to forward to a proxy port on a box on the home network. That's the only traffic I want to cross the bridges. How do I set this up with iptables on the router?

Answer 1

Assuming br0 is the home net, and br1 the guest one:

iptables -t nat -A PREROUTING -i br1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100 # ip of the proxy box

To set up the redirection, then

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

(check if it is not already there) to allow already established connections, it simplifies the rules,

iptables -A FORWARD -m state --state NEW -i br1 -o br0 -p tcp --dport 80 -d 192.168.1.100 -j ACCEPT

Allow connections from the guest net to the proxy box (this gets processed after the DNAT)

iptables -A FORWARD -i br1 -o br0 -j DROP

Forbid all other traffic between the bridges.

Your device is probably already configured as a router, but if not, you may need to enable forwarding too:

echo 1 >/proc/sys/net/ipv4/ip_forward