Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to write iptables string match rule To block http://domain.com:8888 and https://domain.com:8888 when it matches the supplied string in the rule. And another rule to redirect the ports also from 8888 to 7777.

I tried following rules but unfortunately didn't work:

iptables -A INPUT -p tcp -s -m string --string linuxcore --algo bm --sport 8888 -j DROP
iptables -t raw -A PREROUTING -m string --algo bm --string linuxcore -p tcp -i eth0 --dport 8888 -j DROP
iptables -t nat -A PREROUTING -p tcp --dport 8888 -m string --algo bm --string "linuxcore" -j REDIRECT --to-port 7777
iptables  -A INPUT -t nat -p tcp --dport 8888 -m string --algo bm --string "linuxcore" -j DROP
share|improve this question
You can't do a string block on https, its encrypted. – Patrick Jun 6 '12 at 1:02
@Patrick What about the rule used for http .? – linuxcore Jun 6 '12 at 6:28
@linuxcore, you are trying to drive a nail with a screwdriver. Do not block URLs with iptables... block URLs with a proxy like privoxy or squid. – Mike Pennington Jun 6 '12 at 7:12

It looks like you're trying to do something significantly more complicated than I think you want.

What you're asking for:

Block a specific string in the payload (layer 7) of a packet. This will prevent someone from sending an email or IM mentioning a string "linuxcore", or from posting comments in forums about it.

What I think you want:

Redirect packets destined for any IP address resolved by the name domain.com and destined for port 8888 to port 7777.

I'll assume what I think you want, since the former doesn't make very much sense. I am also assuming that you're not interested in matching "foo.domain.com". Remember that it's ip tables, not dns tables.

In this case, lines 1, 2 and 4 are unnecessary. And you don't want string matching. iptables is smart enough to turn names into the appropriate IP addresses and multiplex the rules as necessary. Furthermore, since you're using PREROUTING, know that this will only match coming into your system, not packets leaving your system (if you want to match packets leaving you need to use OUTPUT, or alternatively have one of each).

That rule would look like this:

iptables -t nat -A PREROUTING -d domain.com -p tcp --dport 8888 -j REDIRECT --to-ports 7777 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.