i got the following ruleset for restricting web surfing
Code:
iptables -N webfilter
iptables -I FORWARD -i br0 -p tcp -m webstr --url . -j webfilter
iptables -A webfilter -i br0 -m mac --mac-source 00:xx:xx:xx:xx:4D -j ACCEPT
iptables -A webfilter -i br0 -m webstr --url "yahoo.com< >" -j ACCEPT
iptables -A webfilter -i br0 -p tcp --dport 80 -j DROP
and this for blocking all except some special ports
Code:
iptables -A lan2wan -m mac --mac-source 00:xx:xx:xx:xx:4D -j ACCEPT
iptables -A lan2wan -p tcp --dport 21 -j ACCEPT
iptables -A lan2wan -p tcp --dport 110 -j ACCEPT
iptables -A lan2wan -p tcp --dport 25 -j ACCEPT
iptables -A lan2wan -p tcp --dport 53 -j ACCEPT
iptables -A lan2wan -p udp --dport 53 -j ACCEPT
iptables -A lan2wan -j DROP
(so the mac address 00:xx:xx:xx:xx:4D is fully open with no restriction)
but codes works, but just one at a time, if i insert all rules, it stops working, not sure why the lan2wan rule is blocking all the webpages (even yahoo.com) when suppostly the webfilter chain is first, and it should hit the ACCEPT and pass the packet. Any idea what am I doing wrong?
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
21 11147 webfilter tcp -- br0 * 0.0.0.0/0
0.0.0.0/0 WEBSTR match url .
0 0 ACCEPT all -- br0 br0 0.0.0.0/0
0.0.0.0/0
0 0 logdrop all -- * * 0.0.0.0/0
0.0.0.0/0 state INVALID
0 0 TCPMSS tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x06/0x02 tcpmss match 1461:65535 TCPMSS set
1460
349 23552 lan2wan all -- br0 * 0.0.0.0/0
0.0.0.0/0
410 166K ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- vlan1 * 0.0.0.0/0
224.0.0.0/4 udp
0 0 TRIGGER all -- vlan1 br0 0.0.0.0/0
0.0.0.0/0 TRIGGER type:in match:0 relate:0
5 269 trigger_out all -- br0 * 0.0.0.0/0
0.0.0.0/0
5 269 ACCEPT all -- br0 * 0.0.0.0/0
0.0.0.0/0 state NEW
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0