Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to write iptables string match rule To block http://domain.com:8888 and https://domain.com:8888 when it matches the supplied string in the rule. And another rule to redirect the ports also from 8888 to 7777

I tried following rules but unfortunately didn't work

iptables -A INPUT -p tcp -s 0.0.0.0/0 -m string --string linuxcore --algo bm --sport 8888 -j DROP

iptables -t raw -A PREROUTING -m string --algo bm --string linuxcore -p tcp -i eth0 --dport 8888 -j DROP

iptables -t nat -A PREROUTING -p tcp --dport 8888 -m string --algo bm --string "linuxcore" -j REDIRECT --to-port 7777

iptables -A INPUT -t nat -p tcp --dport 8888 -m string --algo bm --string "linuxcore" -j DROP

I want to do this from iptables not the webserver because the server may not have a webserver and those ports are working on internal proxy or something like ..etc

share|improve this question
add comment

2 Answers

If you mean the access to an HTTP service, this can be done on your web server like apache2. Also, it can be done on a proxy server like squid. However, it is not recommended to filter/deny the traffic based on User-Agent as it can be anything. This is stated in the provided link to apache2 documentation.

Firewalls are not designed to filter/deny such a traffic.

share|improve this answer
    
I think it can be done through firewall I want a rule like this : iptables -t raw -A PREROUTING -m string --algo bm --string MyBrowserUserAgent -j Accept to allow access for port 8888 only for my browseruseragent –  linuxcore Jun 5 '12 at 19:23
    
@linuxcore: Yes, it can be done this way. However, it will not be that reliable. –  Khaled Jun 5 '12 at 19:42
    
Please provide me with a rule using iptables string match To block domain.com:8888 and domain.com:8888 when it matches the supplied string in the rule. And another rule to allow access if it only matches the same string. –  linuxcore Jun 5 '12 at 21:02
add comment

Firstly, if you want this as a security mechanism, don't -- it's horribly insecure. Rather use HTTP authentication, preferably over SSL.

Secondly, this is a job for your webserver, not the firewall. The implementation would depend on which webserver you're using.

share|improve this answer
    
I think it can be done through firewall I want a rule like this : iptables -t raw -A PREROUTING -m string --algo bm --string MyBrowserUserAgent -j Accept to allow access for port 8888 only for my browseruseragent –  linuxcore Jun 5 '12 at 19:21
    
@linuxcore Yes, technically you could achieve this with iptables, but it's definitely not the Right Way. –  mgorven Jun 5 '12 at 19:24
    
I'm not very clever with iptables. Could you provide me with the full iptables rules to do this and to be similar to the above rule .? –  linuxcore Jun 5 '12 at 19:26
    
@linuxcore Just because you can do a thing does not mean you should do it -- what you're asking for is the Wrong Solution. In particular: It won't work for SSL-encrypted requests, and it's insecure in every other case anyway. User-agent-specific handling should be done at the APPLICATION layer (web server, or website software), not the network layer. –  voretaq7 Jun 5 '12 at 19:35
    
@voretaq7 You are right But i want to learn how to do this with iptables even if it was the wrong insecure solution.. Please provide me with a rule using iptables string match To block domain.com:8888 and domain.com:8888 when it matches the supplied string in the rule. And another rule to allow access if it only matches the same string. –  linuxcore Jun 5 '12 at 21:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.