Re: [LARTC] Layer 7 application blocking via tc/iptables?

[Steve Wright <paua@quicksilver.net.nz>]

On Sat, 2003-08-30 at 03:34, Derek wrote:
> Hmm, I don't think I was clear enough in what I was asking (but thank
> you for the responses, still very informative).
> 
> I have a router/firewall running debian with a 2.5.75 kernel and the
> layer7 patch. Basically, I was wondering if someone could give me an
> example of blocking packets using the tc/ip/iptables commands based on
> the protocols in the layer7 patch. Something like
> 
> 
> Client sends AOL IM login request.
> It gets to the firewall and gets dropped because the layer7 patch
> recognized it as an AOL packet.

I think you were clear, but perhaps no-one here is familiar with this
layer7 patch.  I received many blank stares (I imagine) with my
questions about iproute2 to begin with.

The u32 filter will do the job, but you will need to spend some time
reading the docs, and pulling packets apart with ethereal.

u32 basically is a bit-filter.  It will filter on any byte sequence that
you specify, allowing great flexibility, while requiring a complete
understanding of u32 /and/ the protocol you are acting on...
unfortunately..  8-)


/steve




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/