I'm using DD-WRT, and can telnet into it to add iptable rules.

I'm looking for a rule that will allow IN from a specific address (say, mydomain.com) on port 80 that will point to an internal IP (say, Note: I've added an A record to mydomain.com to point to my IP address.

I've tried:

iptables -I INPUT -p tcp --src mydomain.com --dport 80 -j ACCEPT

iptables -I INPUT -p tcp --port 80 -m string --hex-string "|08|mydomain|03|com" -algo bm -j ACCEPT

I know I can log into the DD-WRT web interface and use port forwarding to do this. And if I do this, it works, but I don't want to allow all requests on port 80, just ones with mydomain.com. Is this even possible?

1 Answer 1


You can't do that. A TCP request is started by a SYN packet which contains no data. You get the port numbers and IP addresses, but not the host name.

You might be able to write some complicated rules that accept the connection, and look for the first packet with data to match the Host header—which isn't guaranteed to be in the first data packet, but usually is. Then you'd kill the connection if the first data packet isn't a request for your domain. Of course, then there is the problem if the second request on the connection. And that someone actually trying to bypass your firewall can do all sorts of tricks. E.g., stuff your domain somewhere else in the packet.

If you really need to do filtering like this, you need an HTTP proxy.

PS: I'm not sure what you're trying to match with that hex string. The Host header is in plain ASCII, not DNS's length-string format. So it'd just be --hex-string "mydomain.com".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.