Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to filter out all non-SSL based traffic for a specific port (443).

Is there a way to do this with iptables, or another Linux application?

share|improve this question
1  
May I ask why you would do that? Layer 7 filtering is not the easiest thing in the world –  Christopher Perrin Aug 9 '13 at 12:03
    
There is a load balancer (AWS ELB) in front of the servers, that sends both an SSL and non-SSL health check. The non-SSL "ping" is causing a lot of chaff in the logs, and is impacting the performance of the application. It is not possible to disable the non-SSL ping, hence why I wish to filter it out entirely. –  Nick Aug 9 '13 at 12:09
    
I'm not sure if you get a better performance by this. Filtering at that level is quite complex and can be more CPU heavy. Can't you configure your application to just ignore http traffic on this port? –  Christopher Perrin Aug 9 '13 at 12:13
    
Afraid not, it's bound to the port and can accept any traffic –  Nick Aug 9 '13 at 12:29
    
As wireshark (wiki.wireshark.org/SSL) doesn't support capture filtering SSL, I assume it's not a trivial task iptables can do. Try using HTTP router/reverse proxy (e.g. Nginx, or HAproxy) –  DukeLion Aug 9 '13 at 12:41

1 Answer 1

If the logs are the problem, you might want to filter the request from the logs. If you're using Apache, you can achieve this by adding lines like these to your virtual host config:

    SetEnvIf Request_URI "^/status\.php$" dontlog
    CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.