Administration tool for IPv4/IPv6 TCP/UDP packet filtering.
C Shell M4 Makefile Perl
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.
extensions change matching method Mar 21, 2016
modules change matching method Mar 21, 2016
test update Permission Mar 21, 2016
.clang-format add default clang format Feb 28, 2016
.gitignore kernel3 and kernel2.6 branch merge Feb 23, 2016
.travis.yml testcase 分離 Mar 21, 2016
LICENSE Create LICENSE Feb 25, 2016 perf test data Mar 20, 2016 version increment Mar 26, 2016
iptables-ext-dns.kmod.el6.spec Create Mar 24, 2016 Update Mar 24, 2016 Mar 24, 2016


Administration tool for IPv4/IPv6 TCP/UDP packet filtering.

##build & install see


dns match options:
[!] --qr match when response
[!] --opcode match
[!] --aa match when Authoritative Answer
[!] --tc match when Truncated Response
[!] --rd match when Recursion Desired
[!] --ra match when Recursion Available
[!] --ad match when Authentic Data
[!] --cd match when checking Disabled
[!] --qname
[!] --qtype
    (Flags ex. A,AAAA,MX,NS,TXT,SOA... )
[!] --reverse-match --rmatch reverse matching flag
[!] --maxsize qname max size 

qname size

Qname size is not domain string length. For example "" string length is 15, but qname size is 16. For more information, see RFC1035.


Ex. accept request.

qname option default match mode is exact match.

This sample matches '', but not matches ''.

iptables -A INPUT  -m dns --qname -j ACCEPT
ip6tables -A INPUT  -m dns --qname -j ACCEPT

Ex. drop ${random} request.

rmatch option changes match mode to reverse match.

This sample matches '' and ','.

iptables -A INPUT  -m dns --rmatch --qname -j DROP
ip6tables -A INPUT  -m dns --rmatch --qname -j DROP

Ex. drop ${random} request qname size > 64 .

maxsize option provide qname size filtering.

This sample not matches '' and ''.

but '' is matched

iptables -A INPUT  -m dns --rmatch --qname ! --maxsize 64 -j DROP
ip6tables -A INPUT  -m dns --rmatch --qname ! --maxsize 64 -j DROP

Ex. drop qtype ANY

'qtype' option provide qtype filter.

This sample is drop query when type is ANY.

iptables -A INPUT -m dns --qtype ANY -j DROP
ip6tables -A INPUT -m dns --qtype ANY -j DROP