Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to forward only gmail for the internal using forward drop policy network with no success. This machine is working as a router/firewall for internal network. I am unable to browse to google or gmail. DNS lookup is working and I can successfully do DNS lookup from internal network.

My iptables policy



FORWARD -m string --string "google" --algo bm --to 6745 -j ACCEPT
FORWARD -m string --string "gstatic" --algo bm --to 6745 -j ACCEPT
FORWARD -m string --string "googleusercontent" --algo bm --to 6745 -j ACCEPT

FORWARD -p tcp -m tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

#DNS Lookup and ICMP
FORWARD -p udp -m udp --dport 53 -j ACCEPT
FORWARD -p udp -m udp --sport 53 -j ACCEPT

Any help is greatly appreciated.

Note: I am just posting the rules and policies, not real iptable commands used.

share|improve this question

You can't use string match like that. Basically your SYN packets will be blocked since they don't have 'google' string in it and thus can't be matched by string matcher. You can run tcpdump on the Internet interface and you will see no SYN packet are leaving it. Another problem is that Google changing IP's sometimes and using IP's is not an elegant solution either. If you need per URL filtering, Squid might be an option.

share|improve this answer
Thanks for the answer. I missed SYN packets totally. I will try if i can allow SYN packets to be forwarded. For the time being i have added some ugly rules by locating all the domain names used by gmail and allowed forward on those (much better than finding the hundreds of ips used by google) – bansi Dec 12 '13 at 16:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.