How to block hex-string using iptables MARK

0

I want to block different hex-strings, located in different parts. I try to use iptables with MARK:

Condition:

If it matches the 1st hex-string, then verify the 2nd hex-string. If both match = -j DROP

strings:

1st_hex_string=4503100d97010010930003
2nd_hex_string=d2d2d65c4d96020fa9aac74a60e12cae1ba915a878200001caaa

I try to do it with iptables MARK and the AND and OR operators, but I don't know how to use them. Some examples I found applied to my case:

rule 1:

iptables -A FORWARD -p tcp -m string --hex-string "|$1st_hex_string|" --algo bm -j MARK --or-mark 0x1
iptables -A FORWARD -p tcp -m string --hex-string "|$2nd_hex_string|" --algo bm -j MARK --and-mark 0xFFFFFFFE
iptables -A FORWARD -m mark --mark 0x1/0x1 -j DROP

rule 2:

iptables -A FORWARD -p tcp -m string --hex-string "|$1st_hex_string|" --algo bm -j MARK --set-mark 0x400
iptables -A FORWARD -p tcp -m string --hex-string "|$2nd_hex_string|" --algo bm -j MARK --set-mark 0x401
iptables -A FORWARD -m mark --mark 0x400/0x401 -j DROP

About mark:

mark
This module matches the netfilter mark field associated with a packet (which can be set using the MARK target below).
[!] --mark value[/mask] Matches packets with the given unsigned mark value (if a mask is specified, this is logically ANDed with the mask before the comparison).

Question: how to block these hex-strings with iptabkes MARK (or other way)? Thanks in advanced

linux
iptables
asked on Super User Sep 23, 2019 by ajcg • edited Oct 2, 2019 by ajcg

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0