?
Solved

Packet inspecting firewall with IPTables

Posted on 2004-08-23
8
Medium Priority
?
358 Views
Last Modified: 2010-04-22
Normally IPtables can filter according to where is packet from, which port it is going to etc. I wish to configure it in such a way, only if the "data" contained in the packet matches a specific sequence of bits (ASCII characters or hex), then the IPtables will drop them.

This way, consider an ftp server;

- when a client connects everything is normal
- but when this client uses GLOB command for example, that ascii string will be carried out in the packet
- and when it matches the rule (drop all packets that contain GLOB for ftp port), then that packet will be dropped right away. (also can be logged)

I think it is possible because I have read about it somewhere else, but nothing was written on how to do this exactly.

Any correct (tested) configuration would be appreciated because I really wish to implement this feature...
0
Comment
Question by:Xephyr
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11879887
default you cannot do this with iptables.
You have to build and compile your version and check the patch-o-matic features on www.netfilter.org
I would rather do it with snort and dynamically modify your firewall rules whenever snort detects a source host trying these kinky actions
0
 

Author Comment

by:Xephyr
ID: 11893115
"Full" solution is required... This is not a solution at all...
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11893137
develop your own that it seems you do not have a clue about firewalls
Djeez, being tactful is your strongest point apparently
0
Interactive Way of Training for the AWS CSA Exam

An interactive way of learning that will help you visualize core concepts so that you can be more effective when taking your AWS certification exam.  Built for students by a student to help them understand the concepts that they are being taught.

 

Author Comment

by:Xephyr
ID: 11897917
Back off...
0
 

Author Comment

by:Xephyr
ID: 11897924
Additionally, post "English" in your comments not a bunch of nonsensical words. If you won't, so as I said "back off"
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11899883
it is not because you are noob that you are allowed to insult people
0
 
LVL 1

Accepted Solution

by:
gn0 earned 2000 total points
ID: 11925442
you need to install the 'string' patch to netfilter .... download patch-o-matic from the netfilter download page http://www.netfilter.org/downloads.html#iptables-1.2.11

to install this u will have to have your current kernel sources installed (u should also create a link to the kernel sources named '/usr/src/linux' ).....
u will also have to get the iptables sources .... most likely u will need to install the latest one from netfilter (at the above page) ....

once u have installed the 'string' match.... u wil be able to do something like (cant remember which is the correct ftp port for the commands - i just used both to be safe) ....
iptables -A INPUT -p tcp --dport 20:21  -m string --string 'GLOB' -j DROP
'iptables -L -nv' will give u hits on this rule .....
(NB: this will also affect files with the ascii 'GLOB' inside.... but it is what u asked for .....)

good luck....

Nav.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 11982599
see gn0's suggestion (which works for 2.4 kernels only IIRC)
But according your description you don't want to do it with a packetfilter (iptables), but you need a proxy (sometimes called an application level firewall or adaptive proxy)..
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
Fine Tune your automatic Updates for Ubuntu / Debian
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses
Course of the Month10 days, 19 hours left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question