1

I'd like to route traffic from one Ethernet to another only if a given rule is met. The "rule" is as follows : if a specif value (numeric or string) is found within the packet - the traffic is forwarded, otherwise - discard it. The "rule" should be able to search from a given offset. ( Packet inspection )

Can this be achieved using Linux Standard tools ? ( iproute2\ethtool\ etc' ) ?

Thanks.

closed as unclear what you're asking by Rui F Ribeiro, schily, steve, Romeo Ninov, Kusalananda Jul 9 '18 at 19:53

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I advise writing concise questions. It is not clear what you want to achieve. – Rui F Ribeiro Jul 8 '18 at 7:01
  • Something akin to IPS? – kubanczyk Jul 8 '18 at 8:46
  • 1
    Note that this will only affect single packets, and not the complete stream. In case this is an XY Problem, please describe the X. For example, if X is "I want to handle certain web pages in a special way", consider a transparent proxy. Etc. – dirkt Jul 8 '18 at 11:32
2

You can do that with the module string.

man iptables-extensions:

The string pattern can be used for simple text characters.
iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string 'GET /index.html' -j LOG

The hex string pattern can be used for non-printable characters, like |0D 0A| or |0D0A|.
iptables -p udp --dport 53 -m string --algo bm --from 40 --to 57 --hex-string '|03|www|09|netfilter|03|org|00|'

  • Thanks can iptables rules be "or'd" \ "and" ? – user3087632 Jul 8 '18 at 10:18
  • 1
    @user3087632 All tests within the same iptables call are ANDed. For OR you need several rules. – Hauke Laging Jul 8 '18 at 13:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.