Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for a way to make iptables only accept requests for my domain name and reject the others.

Lately I misconfigured my apache proxy, it is now fixed, but I keep receiving a load of requests looking like that :

xxxx.xx:80 142.54.184.226 - - [12/Sep/2012:15:25:14 +0200] "GET http://ad.bharatstudent.com/st?ad_type=iframe&ad_size=700x300&section=3011105&pub_url=${PUB_URL} HTTP/1.0" 200 4985 "http://www.gethealthbank.com/category/medicine/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0)"
xxxx.xx:80 199.116.113.149 - - [12/Sep/2012:15:25:14 +0200] "GET http://mobile1.login.vip.ird.yahoo.com/config/pwtoken_get?login=heaven_12_&src=ntverifyint&passwd=7698ca276acaf6070487899ad2ee2cb9&challenge=wTBYIo2AEdMFr6LtdyQZPqYw9FS9&md5=1 HTTP/1.0" 200 425 "-" "MobileRunner-J2ME"

which I would like to block.

How can I manage this ?

share|improve this question

migrated from stackoverflow.com Sep 13 '12 at 21:35

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 2 down vote accepted

iptables (network-layer firewalling) is the wrong place to block these requests. It's very hard to make application-level filtering decisions at layer 3, and usually an unreliable hack at best even if you manage it. Look up "layering violation".

I see from the web server logs that those two requests are being answered with 200 status codes, which means they're being accepted and processed. You should configure your HTTP proxy server to refuse them. I see that you have already asked how to do that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.