Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The issue: I am currently redirecting port 80 requests to another system on port 1000.

This is done like so:

iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination 172.20.1.2:1000

However, when adding -m string --algo kmp --string 'MSIE' to filter packets with MSIE in them, they are being ignored due the prerouting only evaluating the first SYN packet(therefore missing the HTTP packets with the headers I am trying to evaluate)

The broken rule:

iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination 172.20.1.2:1000 --algo kmp -m string --string 'MSIE'

My Question: How can I evaluate the HTTP Headers and redirect the packet or fire off a system event when a string match occurs?

share|improve this question
    
Is the "broken rule" exactly how you are entering it? The syntax seems off. –  Tim Jun 25 '13 at 20:28

1 Answer 1

up vote 3 down vote accepted

Quoting the man page:

DNAT (IPv4-specific)

This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined chains which are only called from those chains.

In other words: You lost, it's not possible. And that is obvious as you cannot change the target address in the middle of a connection (without repairing that at the new destination).

You want the application layer, you need an application. Redirect all packets to a (transparent) proxy which can decide what to do with the connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.