Iptables rules for captive portal?

Question

linux

There is a wifi router on the wealan, I can’t realize such a moment as wrapping all traffic so that it goes to the authorization page that will be on the server (it also acts as dhcp), the wealan is spinning on the enp4s0 interface, from another interface that looks in the direction of the provider, I was able to open a pass thanks to such commands.

echo "net.ipv4.ip_forward=1" » /etc/sysctl.con
iptables -t nat -A POSTROUTING -o enp2s0 -j ​​MASQUERADE

Thanks to what iptables rules can you wrap traffic so that unauthorized users leave the stub page to gain access to wifi.

Answer 1

iptables:

*nat
-A PREROUTING -d 10.100.0.220/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 80 -m set ! --match-set mac-allowed src -j DNAT --to-destination 10.100.0.220

*filter
-A FORWARD -i vlan1+ -j macallowed
-A macallowed -d DNS-сервер -p udp -m udp --dport 53 -j ACCEPT
-A macallowed -m set --match-set mac-allowed src -j ACCEPT
-A macallowed -j DROP

ipset:

create mac-allowed hash:mac hashsize 1024 maxelem 65536
add mac-allowed A0:4E:A7:55:44:33

More or less like this.
In nat prerouting, traffic not from the ipset of allowed MAC addresses is wrapped to the host with the portal.
And on the portal, you need to specify the code 511 in the header so that the captive portal detection understands that this is a sandbox and
opens the window for additional actions to connect (although this is not accurate):

header('HTTP/1.1 511 Network Authentication Required', TRUE, 511);
header("Location: http://10.100.0.220/portal/index.php?step=1");

PS. You can do without ipset, but it's faster when there are a lot of records.

Answer 2

create a chain and throw everyone there
if in one L2 segment, then from the DST NAT user's poppy to the captive portal address, after successful authorization delete the user's poppy from the chain