These are the rules I am using:
iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain iptables --table nat --append POSTROUTING --out-interface wlan5 -j MASQUERADE iptables --append FORWARD --in-interface wlan3 -j ACCEPT
I have wlan5 with 192.168.1.100, and wlan3 with 10.0.0.1. I make my laptop a wifi repeater with 2 wifi cards.
So people connect to wlan3, the gateway is 10.0.0.1, and everything redirects to wlan5 [gw 192.168.1.1].
Now, this is working great, except I cannot access a local HTTP server hosted on my laptop. It is hosted on my laptop, and it works as localhost, or 10.0.0.1:
$ curl -I 10.0.0.1 HTTP/1.1 301 Moved Permanently Date: Tue, 26 Feb 2013 02:35:32 GMT Server: Apache/2.2.22 (Ubuntu) Location: http://10.0.0.1/index.php Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1
Ok, so here is where the problem comes up. A client on my sharing network [wlan3] with IP 10.0.0.20 tries to access 10.0.0.1:80 and it cannot connect:
$ wget http://10.0.0.1 Connecting to 10.0.0.1 (10.0.0.1:80) wget: can't connect to remote host (10.0.0.1): Connection refused
It can ping 10.0.0.1 and even ping external IP. so it has internet connection, which is the point, but it cannot access the HTTP, I believe because of the iptables rules. right after the error, I get this on my laptop syslog:
Feb 25 21:36:19 toshi kernel: [57806.285170] Inbound IN=wlan3 OUT= MAC=9c:b7:0d:a5:45:67:a8:26:d9:3e:04:21:08:00 SRC=10.0.0.20 DST=10.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=28282 DF PROTO=TCP SPT=58343 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
So the question is, how can I exclude forwarding IP requests to 10.0.0.1 not forward to wlan5?