0

I have a Ubuntu Server 16 and I use iptables as firewall. HTTP and HTTPS traffic is behind a Reverse Proxy that I cannot control, but I have X-Forwarded-For field activated.

Is it possible to filter out traffic at the iptables stage instead of adding rules in Apache?

If not what is the best way to implement black list in Apache?

Improve this question

2 Answers 2

Reset to default
1

iptables is not able to inspect that deeply into packets. Even if it could, it would only be able to inspect HTTP traffic, not HTTPS. In apache, you can blacklist using the Limit directive.

Improve this answer
2
  • iptables is limited to layer 2, is that correct?
    – jlandercy
    Jan 11, 2017 at 19:30
  • 1
    From the TCP/IP network model layer 2 (Internet layer) you have the IP header, and can filter on things commonly in that, but iptables can also filter based on some details from the TCP/IP layer 3 (transport layer) details for some protocols like tcp/udp.
    – Zoredache
    Jan 11, 2017 at 20:09
1

It actually is quite possible, though it may require a kernel patch depending on your distrubution. There is the string netfilter extension that let's you match specific packets based on if a string is contained within them. We have used it in the past for handling DDOS traffic.

An untested example is here:

# iptables -A INPUT -m string --string 'X-Forwarded-For: badIP' -j DROP

Keep in mind that this is a rather blunt instrument and can result in traffic being unexpectedly dropped- make sure you craft your rules carefully and explicitly. As EEAA stated as well, it will not work on encrypted traffic.

More information is here: https://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-3.html#ss3.18

Improve this answer
7
  • Thank you for sharing this, but not suitable for my needs
    – jlandercy
    Jan 11, 2017 at 19:53
  • 1
    How is it not suitable for your needs? It literally answers your question: Is it possible to filter out traffic at the iptables stage instead of adding rules in Apache?
    – Brennen Smith
    Jan 11, 2017 at 19:54
  • Most of my traffic is HTTPS unfortunately
    – jlandercy
    Jan 11, 2017 at 19:55
  • The link you provide me also explicitly discourage using it for this purpose, thank you anyway
    – jlandercy
    Jan 11, 2017 at 19:56
  • Ah yes - if you are using HTTPS, you will have to do it where the HTTPS connection is terminated. The article only says don't use it for broad things like GET/POST (as they may be strings used in other messages) - using it for explicitly written blocks works very well.
    – Brennen Smith
    Jan 11, 2017 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .