i got the following ruleset for restricting web surfing
Code:
iptables -N webfilter
iptables -I FORWARD -i br0 -p tcp -m webstr --url . -j webfilter
iptables -A webfilter -i br0 -m mac --mac-source 00:xx:xx:xx:xx:4D -j ACCEPT
iptables -A webfilter -i br0 -m webstr --url "yahoo.com< >" -j ACCEPT
iptables -A webfilter -i br0 -p tcp --dport 80 -j DROP
and this for blocking all except some special ports
Code:
iptables -A lan2wan -m mac --mac-source 00:xx:xx:xx:xx:4D -j ACCEPT
iptables -A lan2wan -p tcp --dport 21 -j ACCEPT
iptables -A lan2wan -p tcp --dport 110 -j ACCEPT
iptables -A lan2wan -p tcp --dport 25 -j ACCEPT
iptables -A lan2wan -p tcp --dport 53 -j ACCEPT
iptables -A lan2wan -p udp --dport 53 -j ACCEPT
iptables -A lan2wan -j DROP
(so the mac address 00:xx:xx:xx:xx:4D is fully open with no restriction)
but codes works, but just one at a time, if i insert all rules, it stops working, not sure why the lan2wan rule is blocking all the webpages (even yahoo.com) when suppostly the webfilter chain is first, and it should hit the ACCEPT and pass the packet. Any idea what am I doing wrong?