?
Solved

Packet inspecting firewall with IPTables

Posted on 2004-08-23
8
Medium Priority
?
361 Views
Last Modified: 2010-04-22
Normally IPtables can filter according to where is packet from, which port it is going to etc. I wish to configure it in such a way, only if the "data" contained in the packet matches a specific sequence of bits (ASCII characters or hex), then the IPtables will drop them.

This way, consider an ftp server;

- when a client connects everything is normal
- but when this client uses GLOB command for example, that ascii string will be carried out in the packet
- and when it matches the rule (drop all packets that contain GLOB for ftp port), then that packet will be dropped right away. (also can be logged)

I think it is possible because I have read about it somewhere else, but nothing was written on how to do this exactly.

Any correct (tested) configuration would be appreciated because I really wish to implement this feature...
0
Comment
Question by:Xephyr
8 Comments
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11879887
default you cannot do this with iptables.
You have to build and compile your version and check the patch-o-matic features on www.netfilter.org
I would rather do it with snort and dynamically modify your firewall rules whenever snort detects a source host trying these kinky actions
0
 

Author Comment

by:Xephyr
ID: 11893115
"Full" solution is required... This is not a solution at all...
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11893137
develop your own that it seems you do not have a clue about firewalls
Djeez, being tactful is your strongest point apparently
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 

Author Comment

by:Xephyr
ID: 11897917
Back off...
0
 

Author Comment

by:Xephyr
ID: 11897924
Additionally, post "English" in your comments not a bunch of nonsensical words. If you won't, so as I said "back off"
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11899883
it is not because you are noob that you are allowed to insult people
0
 
LVL 1

Accepted Solution

by:
gn0 earned 2000 total points
ID: 11925442
you need to install the 'string' patch to netfilter .... download patch-o-matic from the netfilter download page http://www.netfilter.org/downloads.html#iptables-1.2.11

to install this u will have to have your current kernel sources installed (u should also create a link to the kernel sources named '/usr/src/linux' ).....
u will also have to get the iptables sources .... most likely u will need to install the latest one from netfilter (at the above page) ....

once u have installed the 'string' match.... u wil be able to do something like (cant remember which is the correct ftp port for the commands - i just used both to be safe) ....
iptables -A INPUT -p tcp --dport 20:21  -m string --string 'GLOB' -j DROP
'iptables -L -nv' will give u hits on this rule .....
(NB: this will also affect files with the ascii 'GLOB' inside.... but it is what u asked for .....)

good luck....

Nav.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 11982599
see gn0's suggestion (which works for 2.4 kernels only IIRC)
But according your description you don't want to do it with a packetfilter (iptables), but you need a proxy (sometimes called an application level firewall or adaptive proxy)..
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
Fine Tune your automatic Updates for Ubuntu / Debian
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question