CentOS, делаю iptables -A FORWARD -s 192.168.1.18 -m string --string "vkontakte.ru" --algo kmp --to 65535 -j DROP
но правило не отрабатывает, видел такую же тему, посему сразу привожу "iptables -vL FORWARD".
Код: Выделить всё
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
6 469 ACCEPT udp -- any any 192.168.4.0/24 anywhere udp dpt:domain
2 126 REJECT udp -- any any 192.168.3.0/24 anywhere udp dpt:domain reject-with icmp-port-unreachable
0 0 REJECT udp -- any any 192.168.4.0/24 anywhere udp dpt:domain reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.33 anywhere tcp dpt:aol reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.34 anywhere tcp dpt:aol reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.37 anywhere tcp dpt:aol reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.41 anywhere tcp dpt:aol reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.33 bucp-m1-vip.blue.aol.com reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.34 login.icq.com reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.37 bucp-m1-vip.blue.aol.com reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.41 login.icq.com reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.33 id.rambler.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.34 id.rambler.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.37 id.rambler.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.41 id.rambler.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.33 64.12.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.34 64.12.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.37 64.12.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.41 64.12.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.33 205.188.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.34 205.188.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.37 205.188.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.4.41 205.188.0.0/16 reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.33 anywhere tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.34 anywhere tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.37 anywhere tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.41 anywhere tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.33 anywhere tcp dpt:mmcc reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.34 anywhere tcp dpt:mmcc reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.37 anywhere tcp dpt:mmcc reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.41 anywhere tcp dpt:mmcc reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.33 anywhere tcp dpt:socalia reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.34 anywhere tcp dpt:socalia reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.37 anywhere tcp dpt:socalia reject-with icmp-port-unreachable
0 0 REJECT tcp -- any any 192.168.4.41 anywhere tcp dpt:socalia reject-with icmp-port-unreachable
0 0 REJECT udp -- any any 192.168.4.33 anywhere udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
3 174 REJECT udp -- any any 192.168.4.34 anywhere udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
1 129 REJECT udp -- any any 192.168.4.37 anywhere udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
0 0 REJECT udp -- any any 192.168.4.41 anywhere udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
35916 13M ACCEPT 0 -- any any 192.168.3.0/24 anywhere
31279 23M ACCEPT 0 -- any any anywhere 192.168.3.0/24
157K 127M ACCEPT 0 -- any any 192.168.4.0/24 anywhere
112K 53M ACCEPT 0 -- any any anywhere 192.168.4.0/24
0 0 ACCEPT 0 -- any any 192.168.5.0/24 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.5.0/24
2433 432K ACCEPT 0 -- any any 192.168.9.10 anywhere
2315 1009K ACCEPT 0 -- any any anywhere 192.168.9.10
4129 735K ACCEPT 0 -- any any 192.168.9.11 anywhere
3773 2146K ACCEPT 0 -- any any anywhere 192.168.9.11
0 0 ACCEPT 0 -- any any 192.168.9.12 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.9.12
88301 31M ACCEPT 0 -- any any 192.168.9.15 anywhere
70091 24M ACCEPT 0 -- any any anywhere 192.168.9.15
66689 4354K ACCEPT 0 -- any any 192.168.9.18 anywhere
119K 173M ACCEPT 0 -- any any anywhere 192.168.9.18
0 0 ACCEPT 0 -- any any 192.168.9.40 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.9.40
0 0 ACCEPT 0 -- any any 192.168.10.15 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.15
39723 3241K ACCEPT 0 -- any any 192.168.10.16 anywhere
71962 97M ACCEPT 0 -- any any anywhere 192.168.10.16
0 0 ACCEPT 0 -- any any 192.168.10.17 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.17
31 3046 ACCEPT 0 -- any any 192.168.10.30 anywhere
41 4304 ACCEPT 0 -- any any anywhere 192.168.10.30
0 0 ACCEPT 0 -- any any 192.168.10.31 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.31
0 0 ACCEPT 0 -- any any 192.168.10.32 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.32
0 0 ACCEPT 0 -- any any 192.168.10.33 anywhere
30 4200 ACCEPT 0 -- any any anywhere 192.168.10.33
0 0 ACCEPT 0 -- any any 192.168.10.34 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.34
92080 62M ACCEPT 0 -- any any 192.168.10.41 anywhere
53511 3578K ACCEPT 0 -- any any anywhere 192.168.10.41
0 0 ACCEPT 0 -- any any 192.168.10.44 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.44
0 0 ACCEPT 0 -- any any 192.168.10.127 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.127
0 0 ACCEPT 0 -- any any 192.168.10.47 anywhere
0 0 ACCEPT 0 -- any any anywhere 192.168.10.47
0 0 REJECT 0 -- any any 192.168.9.18 srv252-131.vkontakte.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.9.18 srv253-131.vkontakte.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.9.18 srv254-131.vkontakte.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.9.18 srv249-131.vkontakte.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.9.18 srv250-131.vkontakte.ru reject-with icmp-port-unreachable
0 0 REJECT 0 -- any any 192.168.9.18 srv251-131.vkontakte.ru reject-with icmp-port-unreachable
0 0 ACCEPT 0 -- any any 192.168.9.0/24 192.168.10.0/24
0 0 ACCEPT 0 -- any any 192.168.10.0/24 192.168.9.0/24
0 0 ACCEPT 0 -- any any 10.0.0.0/8 192.168.9.0/24
0 0 ACCEPT 0 -- any any 192.168.9.0/24 10.0.0.0/8
0 0 ACCEPT 0 -- any any 10.0.0.0/8 192.168.10.0/24
0 0 ACCEPT 0 -- any any 192.168.10.0/24 10.0.0.0/8
201 10100 REJECT 0 -- any any anywhere anywhere reject-with icmp-port-unreachable
[root@InetGate sysconfig]#192.168.10.0/24 - наша подсетка