2

According to my information, it is better not to use the command:

iptables -A INPUT -s example.com -j DROP

Because example.com will be replaced in realtime with an ip address, which will not cover all possible ip addresses.

But if I use:

iptables -A INPUT -m string --string "example" --algo kmp -j DROP

Taken from this answer and I tested it myself, then I no longer need to worry about ip substitution, because "example" will match "example.com" and it will block it.

So if iptables only works with ip addresses, why does it work on names in the second case?

0
2

You cannot search for example.com in the URL as most websites now work via HTTPS exclusively.

Yes, in your example iptables will resolve example.com on a first invocation and in case its IP address changes this rule will no longer work but you could solve it by running e.g. a cron script which resolves example.com and if there's a new IP address it then gets added to your iptables rules via -I or -A.

2
  • But if you use string --string "google" this will block all google websites. So in the second case there is more than first invocation replacement going on..
    – light9876
    Jul 21 '20 at 10:20
  • The question's rule matches also DNS packets, therefore the DNS response from DNS server is dropped because of the rule. Jul 21 '20 at 12:50
2

If you use -m string --string example, it will match all IP packets where the payload contains the string example.

If you go to a page via HTTP and the page contains word example, the page is shown only partially, because your rule drops the packet that contains the word example.

The rule can also break many other protocols that use plain-text. It can also break encrypted connections if the encrypted payload would match to example.

You should use a filtering proxy to block your traffic, it is accurate and doesn't cause unwanted side-effects.

If you don't want to implement a filtering proxy, then a poor man's version is to block DNS queries for your target domain:

EDIT Removed .com due to the fact that DNS packets don't contain dots but length indicators.

iptables -I OUTPUT -p udp --dport 53 -m string --string example -j DROP

This will drop DNS queries for your target domain, effectively blocking the access to those domains. Clients will time out waiting for DNS reply, so the blocking is quite invasive.

4
  • 1
    DNS queries contain null bytes instead of dots - will this actually work?
    – user253751
    Jul 21 '20 at 13:53
  • 2
    They're not always null bytes, but length prefixes. For example, \x07example\x03com\x00 would work. Note also that DNS is case-insensitive and clients can make queries in UPPER or even mIxEd case, so -m string has to be told to be case-insensitive as well. (Overall, a task better handled by actual DNS resolvers such as Unbound.)
    – user1686
    Jul 21 '20 at 14:03
  • @TeroKilkanen But if I do -m string --string "google.com" it breaks all google websites, even though all of them are https. So can we say that it tries to match google.com in the whole ip packet including the destination address and data?
    – light9876
    Jul 21 '20 at 15:24
  • The rule in question acts on response packets from destination server (INPUT chain), it does not act on the request packet sent by the machine itself. Therefore it doesn't match on SNI fields of TLS ClientHello messages. Jul 21 '20 at 16:50
1

Because it is a pattern for strings. Yes, you got your aim. But! If you try to search anything ingluding "example" by google.com you cannt too. Be careful use this setting.

3
  • Thank you. So does it work by searching for "example" in the url?
    – light9876
    Jul 21 '20 at 6:05
  • From man iptables-extensions string This modules matches a given string by using some pattern matching strategy. It requires a linux kernel >= 2.6.14. --algo {bm|kmp} Select the pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth- Pratt-Morris)
    – Paravozik
    Jul 21 '20 at 6:27
  • @light9876 It searches for "example" in the entire packet. The answer is slightly wrong because Google search is encrypted nowadays. But if I'm connected to IRC (unencrypted) and someone says the word "example" in IRC, my IRC connection will stop working. Or if I try to go to example.somewhere-else.com (the DNS response will be dropped). Or if I I load an unencrypted web page with the word "example" in it. Dropping traffic willy-nilly like this will cause strange problems.
    – user253751
    Jul 21 '20 at 13:51
1

Because example.com have to be present in header of most request against server at example.com:

  • If you sent an email, you will put to: john@example.com in the mail header.

  • If you do some HTTP request against example.com, once DNS resolved, minimal request have to contain target host:

    host example.com
    example.com has address 123.45.78.89
    

    DNS request is done on a DNS server, not necessarly at example.com. (if not cached!)

    nc 123.45.67.89 80 <<eoRequest
    GET /index.html HTTP/1.0
    Host: example.com
    eoRequest
    

Of course, your iptable rule will only drop header packet, but following packet won't be understood by server, so will be dropped by server himself. Server logs and client window may prompt something like 400 Bad Request

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.