Feedback to router users during access-restricted hours for DD-WRT

Question

Following router schedule rules that I change often, the stock firmware on my D-Link 825NA rev. B redirects HTTP requests to a built-in "Access denied!" warning at appointed times.

I just upgraded to DD-WRT v24-sp2 (02/17/11) std - build 16214 but its "Access Restrictions" don't give any HTML cut-off reminders my users have come to expect. They mistake the router's DROP rules for connection problems and hit refresh uselessly when blocked in not-so-obvious afternoon hours.

The router has 8MB flash and I'm quite ready to mess around in the shell. Online forums talks about nothing but iptables, which allows / denies but never takes over with custom messages IIRC.

How can DD-WRT show an HTML page warning selected users that the access restrictions block is in effect?

Answer 1

Without knowing any detail about DD-WRT, I think you should be able to concoct an iptables rule that would DNAT all port 80 (HTTP) traffic to a given port on a given host, which could then respond with a standard response regardless the URL requested. You'd need an HTTP server configured to cough up your 'Access Denied' pages, but it'd be doable.

For the DNAT games, you'll need something like this:

iptables -t nat -I PREROUTING -s 192.168.0.0/24 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:8000

with your correct internal subnet numbers for the source (-s), and the actual IP and port for your webserver that's kicking back 'access denied' pages. Naturally, there may be a handy web interface to create that rule; I don't know DD-WRT.

I put that destination value in thinking that you could probably configure the apache demon in the device to listen on that port (particularly on the loopback 127.0.0.1 only) and make your response pages.

Unfortunately, I'm not as handy with Apache, nor do I know how the arrangements are in DD-WRT, so I'll leave that part of the exercise for someone with more knowledge of the DD-WRT details. Good luck!