Solved

Packet inspecting firewall with IPTables

Posted on 2004-08-23
8
356 Views
Last Modified: 2010-04-22
Normally IPtables can filter according to where is packet from, which port it is going to etc. I wish to configure it in such a way, only if the "data" contained in the packet matches a specific sequence of bits (ASCII characters or hex), then the IPtables will drop them.

This way, consider an ftp server;

- when a client connects everything is normal
- but when this client uses GLOB command for example, that ascii string will be carried out in the packet
- and when it matches the rule (drop all packets that contain GLOB for ftp port), then that packet will be dropped right away. (also can be logged)

I think it is possible because I have read about it somewhere else, but nothing was written on how to do this exactly.

Any correct (tested) configuration would be appreciated because I really wish to implement this feature...
0
Comment
Question by:Xephyr
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11879887
default you cannot do this with iptables.
You have to build and compile your version and check the patch-o-matic features on www.netfilter.org
I would rather do it with snort and dynamically modify your firewall rules whenever snort detects a source host trying these kinky actions
0
 

Author Comment

by:Xephyr
ID: 11893115
"Full" solution is required... This is not a solution at all...
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11893137
develop your own that it seems you do not have a clue about firewalls
Djeez, being tactful is your strongest point apparently
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Xephyr
ID: 11897917
Back off...
0
 

Author Comment

by:Xephyr
ID: 11897924
Additionally, post "English" in your comments not a bunch of nonsensical words. If you won't, so as I said "back off"
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11899883
it is not because you are noob that you are allowed to insult people
0
 
LVL 1

Accepted Solution

by:
gn0 earned 500 total points
ID: 11925442
you need to install the 'string' patch to netfilter .... download patch-o-matic from the netfilter download page http://www.netfilter.org/downloads.html#iptables-1.2.11

to install this u will have to have your current kernel sources installed (u should also create a link to the kernel sources named '/usr/src/linux' ).....
u will also have to get the iptables sources .... most likely u will need to install the latest one from netfilter (at the above page) ....

once u have installed the 'string' match.... u wil be able to do something like (cant remember which is the correct ftp port for the commands - i just used both to be safe) ....
iptables -A INPUT -p tcp --dport 20:21  -m string --string 'GLOB' -j DROP
'iptables -L -nv' will give u hits on this rule .....
(NB: this will also affect files with the ascii 'GLOB' inside.... but it is what u asked for .....)

good luck....

Nav.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 11982599
see gn0's suggestion (which works for 2.4 kernels only IIRC)
But according your description you don't want to do it with a packetfilter (iptables), but you need a proxy (sometimes called an application level firewall or adaptive proxy)..
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question