2

To block packets containing some string we use the following iptables rule:

iptables -I FORWARD 1 -p tcp --dport 80 -m string --string anypattern --algo bm -j DROP

This will block the packet containing the string "anypattern".

How to block the next packets (which did not contain the "anypattern" string) but have the same ip address of the matched packet?

is it possible to make it with ip mark ?

I tried the following mark rules but it does not work

iptables -I FORWARD 1 -p tcp --dport 80 -m string --string anypattern --algo bm -j MARK --set-mark 1
iptables -I FORWARD 2 -m mark --mark 1 -j DROP

I tried the followinf command

echo anypattern | nc 192.168.1.1 80

The traffic is blocked

Later I used the same ip and port to send another message

echo othermsg | nc 192.168.1.1 80

I expected that this request will be blocked, But it's not

2
  • You can achieve your objective using the recent module in iptables. I just spent way way too much time on an answer to another of your questions and do not have time now for another. Jan 27, 2020 at 0:21
  • @DougSmythies link of the other question ? Jan 27, 2020 at 6:46

0

You must log in to answer this question.

Browse other questions tagged .