Iptables: Whitelist a specific URL and not just the domain

captive-portalfirewalliptables

How would I whitelist a specific URL with iptables? Currently all requests are blocked.

IE: http://www.apple.com/library/test/success.html

I need to whitelist just this URL so that my captive portal does not trigger the Captive Network Assistant on the iPad. Ideally still blocking requests to www.apple.com.

Additionally, is there a way to make the rule specific to a certain User-Agent?

Thanks!

Best Answer

You need a HTTP proxy. It is impossible to do this with iptables only.

Block access to all HTTP hosts (except of your proxy) with iptables, for all except of the proxy. Then configure the proxy to allow or deny specific URLs.

Related Solutions

Iptables – Dropping incoming requests for a specific file with iptables

Hunch is that iptables rule will use more CPU than apache configuration. But nevertheless it is interesting use of iptables to block incoming requests. As the requests are not gzipped and they are also usually in one single packet I do not see any caveats to your logic.

To understand why current rule is not working I have two suggestions:

Remove -d for a while and see if the rule works. You might have made silly mistake while interpreting destination IP
Capture packets using tcpdump or wireshark and analyse them to see strings that you can match for in requests for bad.php. This will also help in verifying that all bad.php requests actually contain bad.php as expected. Sometimes local rewrite rules may cause requests to go to bad.php while the original request in packet is for good.php making iptables rule fail.

Iptables – How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

Looks awfully complicated....

I think you may find great value in security and performance by just moving sshd and munin to different ports.

Running those services on ports that do not match the default will quell most of the brute force/dos traffic. Fail2ban should be able to pick up any outliers after that.

By moving to custom ports, you essentially create the following:

iptables -A "Anyone that doesn't know the correct ssh port" -j DROP

You can still log attempts to connect to port 22 but I think you could probably find better uses for the disk space.

Best Answer

Related Solutions

Iptables – Dropping incoming requests for a specific file with iptables

Iptables – How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

Related Topic