Using dnsmasq/iptables to redirect DNS/HTTP traffic on Tomato

iptables -I FORWARD -p tcp -d 192.168.1.133 --dport 81 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp -s 192.168.1.103 -d $(nvram get wan_ipaddr) --dport 443 -j DNAT --to 192.168.1.2:443
iptables -I FORWARD -p tcp -d 192.168.1.133 --dport 82 -j ACCEPT

I'm using windows 7 with out port conflict, so dport 81 and 82 remains 80 instead?

this is how I have it and getting trailers is unavailable

router: 121

atv: 108

iptables -t nat -I PREROUTING -p tcp -s 192.168.1.108 -d $(nvram get wan_ipaddr) --dport 80 -j DNAT --to 192.168.1.148:80 iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j ACCEPT iptables -t nat -I PREROUTING -p tcp -s 192.168.1.108 -d $(nvram get wan_ipaddr) --dport 443 -j DNAT --to 192.168.1.148:443 iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j ACCEPT

Not sure if it's just how it's pasted here but the next iptables should be a line down or seperated by an enter.

Like so

iptables -t nat -I PREROUTING -p tcp -s 192.168.1.108 -d $(nvram get wan_ipaddr) --dport 80 -j DNAT --to 192.168.1.148:80 iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp -s 192.168.1.108 -d $(nvram get wan_ipaddr) --dport 443 -j DNAT --to 192.168.1.148:443 iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j ACCEPT

I have it like this:
 
iptables -t nat -I PREROUTING -p tcp -s 192.168.1.108 -d $(nvram get wan_ipaddr) --dport 80 -j DNAT --to 192.168.1.148:80
iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp -s 192.168.1.108 -d $(nvram get wan_ipaddr) --dport 443 -j DNAT --to 192.168.1.148:443
iptables -I FORWARD -p tcp -d 192.168.1.121 --dport 80 -j ACCEPT

Sorry iamjustme,

upon further investigation is would appear that what seems to have resolved my issue with PlexConnect and WHS2011 is what I did in IIs and not the router.  I removed the firewall entries and it still worked :huh:

Again sorry, I'm at my witts end with this.  I have it working when I stop the default sites on IIs which breaks some of the WHS2011 functionality.  If I were able to successfully do the DNSMasq I think it would resolve that issue but this is one step closer than I was yesterday, as I have gotten a positive response from PlexConnect.  Wish I could be more help.

Just a quick hint. It is possible to only let the ATV use the custom DNS for
the trailers website, but all other clients (MAC, PC, smartphones, etc.)
will still get the "real" website.

Following everything like the original posts on page 1 here explain.
Add the following two lines to the Dnsmasq custom configuration:
 

dhcp-mac=appletv, **:**:**:**:**:**
dhcp-option=appletv,6,192.168.0.5

Replace ** with the MAC address of your AppleTV (you can easily see it in
the Tomato WebUI, go to Overview, Device List). And replace the IP with
the IP of your PlexConnect DNS! Make sure you enable that DNS too!

What this does is to give out a different DNS server over DHCP to the AppleTV,
but all other DHCP clients still get the normal answer (your router).
Make sure to renew the DHCP release on the ATV, or to be safe, just reboot it.
This way you can use PlexConnect DNS on your ATV, but all other clients can
still use the trailers website without problems. Unfortunately, if you
turn off your PlexConnect computer, the ATV will still try to connect to it
and it will timeout. But i guess most people will run PlexConnect on their PMS
anyway and it is up 24/7.

I'm using these settings in my firewall script with plexconnect running on port 81 for www and port 82 for SSL.

iptables -t nat -A PREROUTING -i br0 -p tcp --syn -s 10.10.10.121 -d 10.10.10.1 --dport 80 -j DNAT --to-destination 10.10.10.116:81
iptables -t nat -A PREROUTING -i br0 -p tcp --syn -s 10.10.10.121 -d 10.10.10.1 --dport 443 -j DNAT --to-destination 10.10.10.116:82
 
10.10.10.121 is my appletv, 10.10.10.1 is my router and 10.10.10.116 is my synology/plex/plexconnect. I changed the Settings.cfg to run ssl on 82 and www on 81 so I can continue to run my other webservices on 443 and 80 with no disruption.
 
I do have dnsmasq to set the router as the address for trailers.apple.com and atv.plexconnect to 10.10.10.1.
 
Works great so far.

Thank you! This is the only solution that worked for me on this thread.

My router is running Tomato firmware so after some tweaking the following in Administration -> Scripts-> Firewall works:

iptables -t nat -A PREROUTING -p tcp -s 10.0.0.102 -d 10.0.0.1 --dport 80 -j DNAT --to-destination 10.0.0.6:8080
iptables -t nat -A PREROUTING -p tcp -s 10.0.0.102 -d 10.0.0.1 --dport 443 -j DNAT --to-destination 10.0.0.6:8081

And in Advanced -> DHCP/DNS -> Dnsmasq Custom configuration:

address=/trailers.apple.com/10.0.0.1
address=/atv.plexconnect/10.0.0.1

10.0.0.1 = Tomato Router

10.0.0.6 = PMS + PlexConnect

10.0.0.102 = ATV2

Can someone please post the instructions for ddwrt. Specifically the iptables part… Can’t seem to get it forwarding to plex connect server.


Thanks.

The following script sets up everything:

PLEXCONNECT=
PLEXCONNECT_PORT=
PLEXCONNECT_SSL_PORT=
APPLETV=
SERVICE=www.icloud.com # (or trailers.apple.com)

plexconnect_addr=$(expr “$(nslookup 2>/dev/null $PLEXCONNECT|grep ‘^Address’)” : ‘Address.* ([0-9][0-9].[0-9][0-9].[0-9][0-9].[0-9][0-9])’)
appletv_addr=$(expr “$(nslookup 2>/dev/null $APPLETV|grep ‘^Address’)” : ‘Address.* ([0-9][0-9].[0-9][0-9].[0-9][0-9].[0-9][0-9])’)
my_addr=$(expr “$(nslookup $(hostname)|grep ‘^Address’)” : ‘Address.* ([0-9][0-9].[0-9][0-9].[0-9][0-9].[0-9][0-9])’)

iptables -t nat -I PREROUTING -s $appletv_addr -p udp --dport 53 -j DNAT --to-destination $my_addr:${DNS_PORT:-5353}
iptables -t nat -I PREROUTING 2 -s $appletv_addr -p tcp -d $my_addr --dport 80 -j DNAT --to-destination $plexconnect_addr:$PLEXCONNECT_PORT
iptables -t nat -I PREROUTING 3 -s $appletv_addr -p tcp -d $my_addr --dport 443 -j DNAT --to-destination $plexconnect_addr:$PLEXCONNECT_SSL_PORT[
iptables -t nat -I POSTROUTING -s $appletv_addr -p tcp -d $plexconnect_addr --dport $PLEXCONNECT_PORT -j SNAT --to $my_addr
iptables -t nat -I POSTROUTING 2 -s $appletv_addr -p tcp -d $plexconnect_addr --dport $PLEXCONNECT_SSL_PORT -j SNAT --to $my_addr

/usr/sbin/dnsmasq
    --conf-file=/dev/null
    --no-resolv
    --no-hosts
    --listen-address=$my_addr --port=${DNS_PORT:-5353}
    --server=$my_addr
    --cache-size=0
    --host-record=$SERVICE,$my_addr
    --pid-file=/var/run/dnsmasq-plexconnect.pid
    --user=dnsmasq --group=dnsmasq

#ifconfig  promisc # (see note)

 
The idea is:
 
• Run a dedicated instance of dnsmasq, that will forward everything to the “real” dns (except the hijacked host), and redirect all the dns traffic from the appletv to the dedicated dns so that no specific configuration is required on the appletv. 
 
• Redirect the HTTP and HTTP traffic from the appletv to arbitrary ports in the PlexConnect server (the SNAT destinations allow the redirection to work even if the appletv and the PlexConnect server do live on the same network).
 
Note: In some kernel versions there’s a weird interaction between iptables and bridged interfaces (see http://www.spinics.net/lists/netdev/msg268016.html). if the script does not seem to work, and you’re using a bridge (say between ethernet and wifi), you may want to try to uncomment (and adapt) the ifconfig line at the end.

Is there a minimum version of tomato required to run this? I have tried setting this script in the firewall section, but the log file shows dnsmasq FAILED to start each reboot.  Is there another way to debug this script?  

I am running tomato on a WRT54GS v1.1   Yes, old but works great!

Thanks,

Anyone have instructions for Asuswrt Merlin?

I tried the TomatoUSB configuration in Merlin, however it does not work and Trailers app keeps trying and eventually times out.

In dnsmasq.conf.add:

address=/trailers.apple.com/10.0.0.1
address=/atv.plexconnect/10.0.0.1

In firewall-start script:

iptables -t nat -A PREROUTING -p tcp -s 10.0.0.102 -d 10.0.0.1 --dport 80 -j DNAT --to-destination 10.0.0.6:8080
iptables -t nat -A PREROUTING -p tcp -s 10.0.0.102 -d 10.0.0.1 --dport 443 -j DNAT --to-destination 10.0.0.6:8081

However, this configuration is not working in Merlin where as it used to for me in TomatoUSB.

 

Any help will be appreciated.

Hi, I've been testing some of the messages in here, and they all ended up in either no clear results, or the apple TV directly getting disconnected from internet (had to reset the router). Could someone please confirm me which of the many methods listed here are more likely to work on a router (Linksys E2500 v1) with Tomato Firmware 1.28? It would really help me, thanks for reading.

Hi..

new here.. I also use Tomato firmware.. will this redirect block users who edit their hosts file to gain access to blocked websites?

I sugest you to make Jailbreak on your Apple tv device and then will do any you want very easy. I do using this tutorial here iguidesblog.com/jailbreak-apple-tv-3-tv-2-tv-4-free-tool/ and work very good.

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.