Administration tool for IPv4/IPv6 TCP/UDP packet filtering.
C Shell M4 Makefile Perl
Switch branches/tags
Latest commit dafa604 Mar 26, 2016 @mimuret version increment


Administration tool for IPv4/IPv6 TCP/UDP packet filtering.

##build & install see


dns match options:
[!] --qr match when response
[!] --opcode match
[!] --aa match when Authoritative Answer
[!] --tc match when Truncated Response
[!] --rd match when Recursion Desired
[!] --ra match when Recursion Available
[!] --ad match when Authentic Data
[!] --cd match when checking Disabled
[!] --qname
[!] --qtype
    (Flags ex. A,AAAA,MX,NS,TXT,SOA... )
[!] --reverse-match --rmatch reverse matching flag
[!] --maxsize qname max size 

qname size

Qname size is not domain string length. For example "" string length is 15, but qname size is 16. For more information, see RFC1035.


Ex. accept request.

qname option default match mode is exact match.

This sample matches '', but not matches ''.

iptables -A INPUT  -m dns --qname -j ACCEPT
ip6tables -A INPUT  -m dns --qname -j ACCEPT

Ex. drop ${random} request.

rmatch option changes match mode to reverse match.

This sample matches '' and ','.

iptables -A INPUT  -m dns --rmatch --qname -j DROP
ip6tables -A INPUT  -m dns --rmatch --qname -j DROP

Ex. drop ${random} request qname size > 64 .

maxsize option provide qname size filtering.

This sample not matches '' and ''.

but '' is matched

iptables -A INPUT  -m dns --rmatch --qname ! --maxsize 64 -j DROP
ip6tables -A INPUT  -m dns --rmatch --qname ! --maxsize 64 -j DROP

Ex. drop qtype ANY

'qtype' option provide qtype filter.

This sample is drop query when type is ANY.

iptables -A INPUT -m dns --qtype ANY -j DROP
ip6tables -A INPUT -m dns --qtype ANY -j DROP