iptables rule to submit packets matching a specific negative rule

Question

I am using netfilter_queue to pick up certain packets from the kernel and do some processing on them. To, the netfilter queue, I need all packets from a particular source except UDP packets with src port 2152 & dst port 2152.

I try to add the iptable rule as

iptables -A OUTPUT ! s 192.168.0.3 ! -p udp ! --sport 2905 ! --dport 2905 -j NFQUEUE --queue-num 0

iptables throw up an error of Invalid Argument. Querying dmesg, I see the following error print

ip_tables: udp match: only valid for protocol 17

I have tried the following variation with the same error thrown.

iptables -A OUTPUT ! s 192.168.0.3 ! -p udp --sport 2905 --dport 2905 -j NFQUEUE --queue-num 0

Can you please advise on the correct usage of the iptables command for my case.

Answer 1

It might be a lot easier to right your rules if you create a chain, send everything to the chain, and do a RETURN on anything you don't want the chain to handle. With a chain you can add other exceptions later without having to come up with a really convoluted rule.

iptables -t filter -N out_queue
iptables -t filter -A OUTPUT -j out_queue
iptables -t filter -A out_queue -p udp --sport 2905 -j RETURN
iptables -t filter -A out_queue -p udp --dport 2905 -j RETURN
iptables -t filter -A out_queue -j NFQUEUE --queue-num 0

Answer 2

Shouldn't the ! be after the options?

iptables -A OUTPUT -s ! 192.168.0.3 -p udp --sport ! 2905 --dport ! 2905 -j NFQUEUE --queue-num 0

Answer 3

try with:

iptables -A OUTPUT -s 192.168.0.3 -p udp --sport!2905 --dport!2905 -j NFQUEUE --queue-num 0