I am trying to do the post-routing, where I will change the destination IP. I did the following to get the IP address of the
facebook

# host www.facebook.com
www.facebook.com is an alias for star.c10r.facebook.com.
star.c10r.facebook.com has address 31.13.79.65
star.c10r.facebook.com has IPv6 address 2a03:2880:f002:201:face:b00c:0:1

# host www.google.com
www.google.com has address 74.125.236.81
www.google.com has IPv6 address 2404:6800:4001:802::1014

Now, I want whenever the user in my pc tries to access www.facebook.com, the google.com should be connected instead.
Here, I am trying to the destination NAtting. However, I don't see the results. I can open facebook as well as google.

#iptables -t nat -I PREROUTING -d 31.13.79.65 -j DNAT --to-destination 74.125.236.81
#iptables-save

Please correct me here, what is the problem with my rule?

You mean pre-routing NAT.

That is only one of several addresses "www.facebook.com" will resolve to. Most web sites that see heavy traffic use DNS round-robin balancing, often combined with region-specific DNS resolution (the hostname will resolve to a different IP address depending on the client IP).

Besides the fact that you've only NATed one address out of many used by Facebook, you can't really redirect web requests like that.

Even if you manage to successfully NAT all the addresses involved, the client web browser will still send the following request to the web server:Many web servers will return an error message if you ask for a domain the server isn't configured to serve, or it may serve a page from the "default virtual host", which may be an entirely different site than the one you wished to redirect the clients to.

It seems Google's web server will respond to requests for non-hosted sites with a "302" redirect to "http://www.google.com/". This is by no means typical behaviour for a web server, but it means that in this particular case an IP redirect should in fact work.

If you want to reliably redirect web traffic in general, you'll have to use a proxy server.

Then, what is the usage of Pre-routing DNAT? I am trying to make a practical example on Pre-routing DNAT. I thought this example will server, but as you told it will not work here. I actually made a firewall for one of the adult website, whenever a user tries to acess it , it gets rejected. I used dport, sport. Can't I combine dport, sport for http, and https with the pre-routing DNAT? I tried something like that, but it fails.

#iptables -t nat -I PREROUTING -p tcp --dport 80 -d 31.13.79.65 -j DNAT --to-destination 74.125.236.81
#iptables -t nat -I PREROUTING -p tcp --dport 443 -d 31.13.79.65 -j DNAT --to-destination 74.125.236.81


also, I added sport for the rules. It didn't work. I understand your DNS concern, but I am changing the destination IP. This is done pre-routing. So, before the packet leaves my pc, the destination ip is changed to some other ip. How, the DNS resolution into the picture here.

I didn't say destination NAT doesn't work. It most certainly does.

What I did say, was:

• Redirecting a single IP address may not be sufficient to handle all traffic to a given hostname, as a hostname can resolve to multiple IP adresses.
• For HTTP and HTTPS, a reference to the hostname is included in the application-layer traffic (which is why virtual hosting works in the first place), so simply redirecting that traffic to a different server may yield unpredictable results, including error messages.

Using iptables to do that might not be the best approach. The /etc/hosts file could be used to do local DNS and assign googles IP address to facebook. But if google and facebook are hosted at the same IP address, you'd still get facebook. You could swap the destination ip address, but facebook has many ip addresses, which would take many rules and need maintenance to stay current. You can setup a webpage with rules to redirect to google, via html content or .htaccess on the webserver. Or a variety of other methods and products designed for this type of thing.