Solved

Packet inspecting firewall with IPTables

Posted on 2004-08-23
8
353 Views
Last Modified: 2010-04-22
Normally IPtables can filter according to where is packet from, which port it is going to etc. I wish to configure it in such a way, only if the "data" contained in the packet matches a specific sequence of bits (ASCII characters or hex), then the IPtables will drop them.

This way, consider an ftp server;

- when a client connects everything is normal
- but when this client uses GLOB command for example, that ascii string will be carried out in the packet
- and when it matches the rule (drop all packets that contain GLOB for ftp port), then that packet will be dropped right away. (also can be logged)

I think it is possible because I have read about it somewhere else, but nothing was written on how to do this exactly.

Any correct (tested) configuration would be appreciated because I really wish to implement this feature...
0
Comment
Question by:Xephyr
8 Comments
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11879887
default you cannot do this with iptables.
You have to build and compile your version and check the patch-o-matic features on www.netfilter.org
I would rather do it with snort and dynamically modify your firewall rules whenever snort detects a source host trying these kinky actions
0
 

Author Comment

by:Xephyr
ID: 11893115
"Full" solution is required... This is not a solution at all...
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11893137
develop your own that it seems you do not have a clue about firewalls
Djeez, being tactful is your strongest point apparently
0
Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

 

Author Comment

by:Xephyr
ID: 11897917
Back off...
0
 

Author Comment

by:Xephyr
ID: 11897924
Additionally, post "English" in your comments not a bunch of nonsensical words. If you won't, so as I said "back off"
0
 
LVL 6

Expert Comment

by:bloemkool1980
ID: 11899883
it is not because you are noob that you are allowed to insult people
0
 
LVL 1

Accepted Solution

by:
gn0 earned 500 total points
ID: 11925442
you need to install the 'string' patch to netfilter .... download patch-o-matic from the netfilter download page http://www.netfilter.org/downloads.html#iptables-1.2.11

to install this u will have to have your current kernel sources installed (u should also create a link to the kernel sources named '/usr/src/linux' ).....
u will also have to get the iptables sources .... most likely u will need to install the latest one from netfilter (at the above page) ....

once u have installed the 'string' match.... u wil be able to do something like (cant remember which is the correct ftp port for the commands - i just used both to be safe) ....
iptables -A INPUT -p tcp --dport 20:21  -m string --string 'GLOB' -j DROP
'iptables -L -nv' will give u hits on this rule .....
(NB: this will also affect files with the ascii 'GLOB' inside.... but it is what u asked for .....)

good luck....

Nav.
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 11982599
see gn0's suggestion (which works for 2.4 kernels only IIRC)
But according your description you don't want to do it with a packetfilter (iptables), but you need a proxy (sometimes called an application level firewall or adaptive proxy)..
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
In a recent question (https://www.experts-exchange.com/questions/28997919/Pagination-in-Adobe-Acrobat.html) here at Experts Exchange, a member asked how to add page numbers to a PDF file using Adobe Acrobat XI Pro. This short video Micro Tutorial sh…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now