Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Under CentOS, how can I filter traffic by protocol rather than by port?

For example, I would like to filter ftp traffic regardless of the port being used in order to prevent users on the network from using ftp.

I would like to drop the packet, not reject them.

share|improve this question
Why the downvotes? This is a legitimate, although rudimentary, question. – kce Feb 2 '12 at 20:09
Agreed. It seems entirely on target for serverfault. – larsks Feb 2 '12 at 20:15
up vote 4 down vote accepted

What you are asking about is typically called an "application layer" firewall or "layer 7" firewall because it operates at layer 7 of the OSI model. A layer 7 filter operates by inspecting all packets passing through the firewall in order to identify the protocol in use.

There is a layer 7 classifier available for use with Netfilter, the Linux firewall implementation. It doesn't appear to be an especially active project, but neither is completely stale -- the last update on the main page appears to be from January of last year.

I don't have any personal experience with this module.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.