Re: iptables http problems

[Amin Azez <azez@ufomechanic.net>]

Paolo Cerrito wrote:
> Hi, i'm writing a userspace application, using nfnetlink_queue. Can i
> write a rule for iptables that send on a queue http packets? the problem
> is that i have to distinguish the packets for apllication layer
> protocols. Is there a way for that?

You could look at: http://l7-filter.sourceforge.net/
Which is an iptables module that recognizes application layer protocols.

Be aware that it is hard to do reliable patterns for some applications,
and also that in order to recognize a layer 7 application iptables must
be monitoring the connection when it starts.

Any connections already active before the rule is active might not be
recognized.

Further realize, that it takes a few packets sometimes to gather enough
data to recognize the application layer protocol, especially if someone
is trying to hide their traffic by using very very small packets, and so
you may not recognize the application layer on the first packet, so you
may not be able to use this for totally blocking data based on
application layer as some packets may get through before classification
is complete.

Sam