Solved

Packet inspecting firewall with IPTables

Posted on 2004-08-23
8
352 Views
Last Modified: 2010-04-22
Normally IPtables can filter according to where is packet from, which port it is going to etc. I wish to configure it in such a way, only if the "data" contained in the packet matches a specific sequence of bits (ASCII characters or hex), then the IPtables will drop them.

This way, consider an ftp server;

- when a client connects everything is normal
- but when this client uses GLOB command for example, that ascii string will be carried out in the packet
- and when it matches the rule (drop all packets that contain GLOB for ftp port), then that packet will be dropped right away. (also can be logged)

I think it is possible because I have read about it somewhere else, but nothing was written on how to do this exactly.

Any correct (tested) configuration would be appreciated because I really wish to implement this feature...
0
Comment
Question by:Xephyr
8 Comments
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11879887
default you cannot do this with iptables.
You have to build and compile your version and check the patch-o-matic features on www.netfilter.org
I would rather do it with snort and dynamically modify your firewall rules whenever snort detects a source host trying these kinky actions
0
 

Author Comment

by:Xephyr
ID: 11893115
"Full" solution is required... This is not a solution at all...
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11893137
develop your own that it seems you do not have a clue about firewalls
Djeez, being tactful is your strongest point apparently
0
 

Author Comment

by:Xephyr
ID: 11897917
Back off...
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:Xephyr
ID: 11897924
Additionally, post "English" in your comments not a bunch of nonsensical words. If you won't, so as I said "back off"
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11899883
it is not because you are noob that you are allowed to insult people
0
 
LVL 1

Accepted Solution

by:
gn0 earned 500 total points
ID: 11925442
you need to install the 'string' patch to netfilter .... download patch-o-matic from the netfilter download page http://www.netfilter.org/downloads.html#iptables-1.2.11

to install this u will have to have your current kernel sources installed (u should also create a link to the kernel sources named '/usr/src/linux' ).....
u will also have to get the iptables sources .... most likely u will need to install the latest one from netfilter (at the above page) ....

once u have installed the 'string' match.... u wil be able to do something like (cant remember which is the correct ftp port for the commands - i just used both to be safe) ....
iptables -A INPUT -p tcp --dport 20:21  -m string --string 'GLOB' -j DROP
'iptables -L -nv' will give u hits on this rule .....
(NB: this will also affect files with the ascii 'GLOB' inside.... but it is what u asked for .....)

good luck....

Nav.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 11982599
see gn0's suggestion (which works for 2.4 kernels only IIRC)
But according your description you don't want to do it with a packetfilter (iptables), but you need a proxy (sometimes called an application level firewall or adaptive proxy)..
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Fine Tune your automatic Updates for Ubuntu / Debian
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now