Administration tool for IPv4/IPv6 TCP/UDP packet filtering.
C Shell M4 Makefile Perl
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
extensions change matching method Mar 21, 2016
include
modules change matching method Mar 21, 2016
perf
test update Permission Mar 21, 2016
.clang-format add default clang format Feb 28, 2016
.gitignore kernel3 and kernel2.6 branch merge Feb 23, 2016
.travis.yml testcase 分離 Mar 21, 2016
LICENSE Create LICENSE Feb 25, 2016
Makefile.am perf test data Mar 20, 2016
README.md
autogen.sh
configure.ac version increment Mar 26, 2016
install-dependencies.sh
iptables-ext-dns.kmod.el6.spec
iptables-ext-dns.spec.1.1.0.in Create iptables-ext-dns.spec.1.1.0.in Mar 24, 2016
iptables-ext-dns.spec.in Update iptables-ext-dns.spec.in Mar 24, 2016
kmodtool-iptables-ext-dns-el6.sh kmodtool-iptables-ext-dns-el6.sh Mar 24, 2016

README.md

iptables-ext-dns

Administration tool for IPv4/IPv6 TCP/UDP packet filtering.

##build & install see https://github.com/mimuret/iptables-ext-dns/wiki/install

Usage

dns match options:
[!] --qr match when response
[!] --opcode match
      (Flags QUERY,IQUERY,STATUS,NOTIFY,UPDATE)
[!] --aa match when Authoritative Answer
[!] --tc match when Truncated Response
[!] --rd match when Recursion Desired
[!] --ra match when Recursion Available
[!] --ad match when Authentic Data
[!] --cd match when checking Disabled
[!] --qname
[!] --qtype
    (Flags ex. A,AAAA,MX,NS,TXT,SOA... )
        see. http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
[!] --reverse-match --rmatch reverse matching flag
[!] --maxsize qname max size 

qname size

Qname size is not domain string length. For example "www.example.jp." string length is 15, but qname size is 16. For more information, see RFC1035.

Example

Ex. accept example.jp request.

qname option default match mode is exact match.

This sample matches 'example.jp', but not matches 'hogehoge.example.jp'.

iptables -A INPUT  -m dns --qname example.jp -j ACCEPT
ip6tables -A INPUT  -m dns --qname example.jp -j ACCEPT

Ex. drop ${random}.example.jp. request.

rmatch option changes match mode to reverse match.

This sample matches 'example.jp' and 'hogehoge.example.jp,'.

iptables -A INPUT  -m dns --rmatch --qname example.jp -j DROP
ip6tables -A INPUT  -m dns --rmatch --qname example.jp -j DROP

Ex. drop ${random}.example.jp. request qname size > 64 .

maxsize option provide qname size filtering.

This sample not matches 'example.jp.' and 'hogehoge.example.jp.'.

but 'OJcoaTh297tDwtkNCAV2vtLwh3P0S6Ldce6Oas0Sug6YJGCniluVLoEPBBIOTEr.example.jp.' is matched

iptables -A INPUT  -m dns --rmatch --qname example.jp ! --maxsize 64 -j DROP
ip6tables -A INPUT  -m dns --rmatch --qname example.jp ! --maxsize 64 -j DROP

Ex. drop qtype ANY

'qtype' option provide qtype filter.

This sample is drop query when type is ANY.

iptables -A INPUT -m dns --qtype ANY -j DROP
ip6tables -A INPUT -m dns --qtype ANY -j DROP