-1

I'm trying to write iptables string match rule To block http://domain.com:8888 and https://domain.com:8888 when it matches the supplied string in the rule. And another rule to redirect the ports also from 8888 to 7777

I tried following rules but unfortunately didn't work

iptables -A INPUT -p tcp -s 0.0.0.0/0 -m string --string linuxcore --algo bm --sport 8888 -j DROP

iptables -t raw -A PREROUTING -m string --algo bm --string linuxcore -p tcp -i eth0 --dport 8888 -j DROP

iptables -t nat -A PREROUTING -p tcp --dport 8888 -m string --algo bm --string "linuxcore" -j REDIRECT --to-port 7777

iptables -A INPUT -t nat -p tcp --dport 8888 -m string --algo bm --string "linuxcore" -j DROP

I want to do this from iptables not the webserver because the server may not have a webserver and those ports are working on internal proxy or something like ..etc

2 Answers 2

2

If you mean the access to an HTTP service, this can be done on your web server like apache2. Also, it can be done on a proxy server like squid. However, it is not recommended to filter/deny the traffic based on User-Agent as it can be anything. This is stated in the provided link to apache2 documentation.

Firewalls are not designed to filter/deny such a traffic.

3
  • I think it can be done through firewall I want a rule like this : iptables -t raw -A PREROUTING -m string --algo bm --string MyBrowserUserAgent -j Accept to allow access for port 8888 only for my browseruseragent
    – linuxcore
    Jun 5, 2012 at 19:23
  • @linuxcore: Yes, it can be done this way. However, it will not be that reliable.
    – Khaled
    Jun 5, 2012 at 19:42
  • Please provide me with a rule using iptables string match To block domain.com:8888 and domain.com:8888 when it matches the supplied string in the rule. And another rule to allow access if it only matches the same string.
    – linuxcore
    Jun 5, 2012 at 21:02
2

Firstly, if you want this as a security mechanism, don't -- it's horribly insecure. Rather use HTTP authentication, preferably over SSL.

Secondly, this is a job for your webserver, not the firewall. The implementation would depend on which webserver you're using.

5
  • I think it can be done through firewall I want a rule like this : iptables -t raw -A PREROUTING -m string --algo bm --string MyBrowserUserAgent -j Accept to allow access for port 8888 only for my browseruseragent
    – linuxcore
    Jun 5, 2012 at 19:21
  • @linuxcore Yes, technically you could achieve this with iptables, but it's definitely not the Right Way.
    – mgorven
    Jun 5, 2012 at 19:24
  • I'm not very clever with iptables. Could you provide me with the full iptables rules to do this and to be similar to the above rule .?
    – linuxcore
    Jun 5, 2012 at 19:26
  • @linuxcore Just because you can do a thing does not mean you should do it -- what you're asking for is the Wrong Solution. In particular: It won't work for SSL-encrypted requests, and it's insecure in every other case anyway. User-agent-specific handling should be done at the APPLICATION layer (web server, or website software), not the network layer.
    – voretaq7
    Jun 5, 2012 at 19:35
  • @voretaq7 You are right But i want to learn how to do this with iptables even if it was the wrong insecure solution.. Please provide me with a rule using iptables string match To block domain.com:8888 and domain.com:8888 when it matches the supplied string in the rule. And another rule to allow access if it only matches the same string.
    – linuxcore
    Jun 5, 2012 at 21:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .