The issue: I am currently redirecting port 80 requests to another system on port 1000.
This is done like so:
iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination 172.20.1.2:1000
However, when adding
-m string --algo kmp --string 'MSIE' to filter packets with MSIE in them, they are being ignored due the prerouting only evaluating the first SYN packet(therefore missing the HTTP packets with the headers I am trying to evaluate)
The broken rule:
iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination 172.20.1.2:1000 --algo kmp -m string --string 'MSIE'
My Question: How can I evaluate the HTTP Headers and redirect the packet or fire off a system event when a string match occurs?