iptables -F
iptables -X

iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -t mangle -N internet
iptables -t mangle -A internet -j MARK --set-mark 99

iptables -t mangle -A PREROUTING -i wlan0 -p tcp -m tcp --dport 1:65535 -j internet
iptables -t nat -A PREROUTING -i wlan0 -p tcp -m mark --mark 99 -m tcp --dport 1:65535 -j DNAT --to-destination 10.0.0.254

# put some rules here to add the exceptions for the packets from being redirected to 10.0.0.254
# the '-t mangle -I internet 1' argument means that we insert this rule to the beginning of mangle table
# so that if the rule hit then no further processing in mangle table will be taken to the packet.

iptables -t mangle -I internet 1 -p tcp -m tcp -s [source IP address to unblock] --dport 80 -j RETURN