Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to forward only gmail for the internal using forward drop policy network with no success. This machine is working as a router/firewall for internal network. I am unable to browse to google or gmail. DNS lookup is working and I can successfully do DNS lookup from internal network.

My iptables policy

INPUT ACCEPT
OUTPUT ACCEPT
FORWARD DROP

Rules

FORWARD -m string --string "google" --algo bm --to 6745 -j ACCEPT
FORWARD -m string --string "gstatic" --algo bm --to 6745 -j ACCEPT
FORWARD -m string --string "googleusercontent" --algo bm --to 6745 -j ACCEPT

FORWARD -p tcp -m tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

#DNS Lookup and ICMP
FORWARD -p udp -m udp --dport 53 -j ACCEPT
FORWARD -p udp -m udp --sport 53 -j ACCEPT
FORWARD -p icmp -j ACCEPT

Any help is greatly appreciated.

Note: I am just posting the rules and policies, not real iptable commands used.

share|improve this question
add comment

1 Answer

You can't use string match like that. Basically your SYN packets will be blocked since they don't have 'google' string in it and thus can't be matched by string matcher. You can run tcpdump on the Internet interface and you will see no SYN packet are leaving it. Another problem is that Google changing IP's sometimes and using IP's is not an elegant solution either. If you need per URL filtering, Squid might be an option.

share|improve this answer
    
Thanks for the answer. I missed SYN packets totally. I will try if i can allow SYN packets to be forwarded. For the time being i have added some ugly rules by locating all the domain names used by gmail and allowed forward on those (much better than finding the hundreds of ips used by google) –  bansi Dec 12 '13 at 16:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.