Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Following router schedule rules that I change often, the stock firmware on my D-Link 825NA rev. B redirects HTTP requests to a built-in "Access denied!" warning at appointed times.

I just upgraded to DD-WRT v24-sp2 (02/17/11) std - build 16214 but its "Access Restrictions" don't give any HTML cut-off reminders my users have come to expect. They mistake the router's DROP rules for connection problems and hit refresh uselessly when blocked in not-so-obvious afternoon hours.

The router has 8MB flash and I'm quite ready to mess around in the shell. Online forums talks about nothing but iptables, which allows / denies but never takes over with custom messages IIRC.

How can DD-WRT show an HTML page warning selected users that the access restrictions block is in effect?

share|improve this question
up vote 2 down vote accepted

Without knowing any detail about DD-WRT, I think you should be able to concoct an iptables rule that would DNAT all port 80 (HTTP) traffic to a given port on a given host, which could then respond with a standard response regardless the URL requested. You'd need an HTTP server configured to cough up your 'Access Denied' pages, but it'd be doable.

For the DNAT games, you'll need something like this:

iptables -t nat -I PREROUTING -s -p tcp --dport 80 -j DNAT --to-destination

with your correct internal subnet numbers for the source (-s), and the actual IP and port for your webserver that's kicking back 'access denied' pages. Naturally, there may be a handy web interface to create that rule; I don't know DD-WRT.

I put that destination value in thinking that you could probably configure the apache demon in the device to listen on that port (particularly on the loopback only) and make your response pages.

Unfortunately, I'm not as handy with Apache, nor do I know how the arrangements are in DD-WRT, so I'll leave that part of the exercise for someone with more knowledge of the DD-WRT details. Good luck!

share|improve this answer
The DNAT redirection part is great! I have my PC's set up so that some would-be advertisement traffic gets redirected to an Apache server on port 80, replacing website ad snippets with "(Ad deleted)". I'll make it also respond "Access Denied" to only port 8000 traffic coming from your iptables idea. The only missing step is non-permanent scheduling, where a helper with deep DD-WRT CLI knowledge will be convenient. – Vlueboy Apr 2 '11 at 17:06
Giving up on waiting for other answers. Thanks for your quick help. DD-WRT seems to have a bug with SNAT redirection (good only for external redirects.) It also had problems with implementing walkthroughs that apparently work full in real Linux distributions. – Vlueboy May 17 '11 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .