Решено: iptables и -m string --string "vkontakte" --algo kmp, Нужен совет знающих людей.

Обсуждение настройки и работы сервисов, резервирования, сетевых настроек и вопросов безопасности ОС.

Модераторы: SLEDopit, Модераторы разделов

BurnRam
Сообщения: 4
ОС: CentOS, Mandriva, Mint

Решено: iptables и -m string --string "vkontakte" --algo kmp, Нужен совет знающих людей.

Сообщение BurnRam »

и снова фильтрация
CentOS, делаю iptables -A FORWARD -s 192.168.1.18 -m string --string "vkontakte.ru" --algo kmp --to 65535 -j DROP

но правило не отрабатывает, видел такую же тему, посему сразу привожу "iptables -vL FORWARD".

Код: Выделить всё

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    6   469 ACCEPT     udp  --  any    any     192.168.4.0/24       anywhere            udp dpt:domain
    2   126 REJECT     udp  --  any    any     192.168.3.0/24       anywhere            udp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  any    any     192.168.4.0/24       anywhere            udp dpt:domain reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.33         anywhere            tcp dpt:aol reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.34         anywhere            tcp dpt:aol reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.37         anywhere            tcp dpt:aol reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.41         anywhere            tcp dpt:aol reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.33         bucp-m1-vip.blue.aol.com reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.34         login.icq.com       reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.37         bucp-m1-vip.blue.aol.com reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.41         login.icq.com       reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.33         id.rambler.ru       reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.34         id.rambler.ru       reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.37         id.rambler.ru       reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.41         id.rambler.ru       reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.33         64.12.0.0/16        reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.34         64.12.0.0/16        reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.37         64.12.0.0/16        reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.41         64.12.0.0/16        reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.33         205.188.0.0/16      reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.34         205.188.0.0/16      reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.37         205.188.0.0/16      reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.4.41         205.188.0.0/16      reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.33         anywhere            tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.34         anywhere            tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.37         anywhere            tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.41         anywhere            tcp dpts:commplex-main:commplex-link reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.33         anywhere            tcp dpt:mmcc reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.34         anywhere            tcp dpt:mmcc reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.37         anywhere            tcp dpt:mmcc reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.41         anywhere            tcp dpt:mmcc reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.33         anywhere            tcp dpt:socalia reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.34         anywhere            tcp dpt:socalia reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.37         anywhere            tcp dpt:socalia reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  any    any     192.168.4.41         anywhere            tcp dpt:socalia reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  any    any     192.168.4.33         anywhere            udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
    3   174 REJECT     udp  --  any    any     192.168.4.34         anywhere            udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
    1   129 REJECT     udp  --  any    any     192.168.4.37         anywhere            udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  any    any     192.168.4.41         anywhere            udp dpts:commplex-main:telelpathstart reject-with icmp-port-unreachable
35916   13M ACCEPT     0    --  any    any     192.168.3.0/24       anywhere
31279   23M ACCEPT     0    --  any    any     anywhere             192.168.3.0/24
 157K  127M ACCEPT     0    --  any    any     192.168.4.0/24       anywhere
 112K   53M ACCEPT     0    --  any    any     anywhere             192.168.4.0/24
    0     0 ACCEPT     0    --  any    any     192.168.5.0/24       anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.5.0/24
 2433  432K ACCEPT     0    --  any    any     192.168.9.10         anywhere
 2315 1009K ACCEPT     0    --  any    any     anywhere             192.168.9.10
 4129  735K ACCEPT     0    --  any    any     192.168.9.11         anywhere
 3773 2146K ACCEPT     0    --  any    any     anywhere             192.168.9.11
    0     0 ACCEPT     0    --  any    any     192.168.9.12         anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.9.12
88301   31M ACCEPT     0    --  any    any     192.168.9.15         anywhere
70091   24M ACCEPT     0    --  any    any     anywhere             192.168.9.15
66689 4354K ACCEPT     0    --  any    any     192.168.9.18         anywhere
 119K  173M ACCEPT     0    --  any    any     anywhere             192.168.9.18
    0     0 ACCEPT     0    --  any    any     192.168.9.40         anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.9.40
    0     0 ACCEPT     0    --  any    any     192.168.10.15        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.15
39723 3241K ACCEPT     0    --  any    any     192.168.10.16        anywhere
71962   97M ACCEPT     0    --  any    any     anywhere             192.168.10.16
    0     0 ACCEPT     0    --  any    any     192.168.10.17        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.17
   31  3046 ACCEPT     0    --  any    any     192.168.10.30        anywhere
   41  4304 ACCEPT     0    --  any    any     anywhere             192.168.10.30
    0     0 ACCEPT     0    --  any    any     192.168.10.31        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.31
    0     0 ACCEPT     0    --  any    any     192.168.10.32        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.32
    0     0 ACCEPT     0    --  any    any     192.168.10.33        anywhere
   30  4200 ACCEPT     0    --  any    any     anywhere             192.168.10.33
    0     0 ACCEPT     0    --  any    any     192.168.10.34        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.34
92080   62M ACCEPT     0    --  any    any     192.168.10.41        anywhere
53511 3578K ACCEPT     0    --  any    any     anywhere             192.168.10.41
    0     0 ACCEPT     0    --  any    any     192.168.10.44        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.44
    0     0 ACCEPT     0    --  any    any     192.168.10.127       anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.127
    0     0 ACCEPT     0    --  any    any     192.168.10.47        anywhere
    0     0 ACCEPT     0    --  any    any     anywhere             192.168.10.47
    0     0 REJECT     0    --  any    any     192.168.9.18         srv252-131.vkontakte.ru reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.9.18         srv253-131.vkontakte.ru reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.9.18         srv254-131.vkontakte.ru reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.9.18         srv249-131.vkontakte.ru reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.9.18         srv250-131.vkontakte.ru reject-with icmp-port-unreachable
    0     0 REJECT     0    --  any    any     192.168.9.18         srv251-131.vkontakte.ru reject-with icmp-port-unreachable
    0     0 ACCEPT     0    --  any    any     192.168.9.0/24       192.168.10.0/24
    0     0 ACCEPT     0    --  any    any     192.168.10.0/24      192.168.9.0/24
    0     0 ACCEPT     0    --  any    any     10.0.0.0/8           192.168.9.0/24
    0     0 ACCEPT     0    --  any    any     192.168.9.0/24       10.0.0.0/8
    0     0 ACCEPT     0    --  any    any     10.0.0.0/8           192.168.10.0/24
    0     0 ACCEPT     0    --  any    any     192.168.10.0/24      10.0.0.0/8
  201 10100 REJECT     0    --  any    any     anywhere             anywhere            reject-with icmp-port-unreachable
[root@InetGate sysconfig]#


192.168.10.0/24 - наша подсетка

Спасибо сказали:
BurnRam
Сообщения: 4
ОС: CentOS, Mandriva, Mint

Re: Решено: iptables и -m string --string "vkontakte" --algo kmp, Нужен совет знающих людей.

Сообщение BurnRam »

Разобрался сам.

#!/bin/bash
#Баним развлекательные, порно и прокси
HOSTS=`/bin/grep -v ‘#’ /etc/black/blackurls`
for i in $HOSTS; do
iptables -A OUTPUT -d 192.168.9.14 -m string --string "$i" --algo kmp --to 65535 -j REJECT
iptables -A OUTPUT -s 192.168.9.14 -m string --string "$i" --algo kmp --to 65535 -j REJECT
done

Работает на ура, может кому пригодится
[Решено]
Спасибо сказали: