0

We can mark packets on the basis of IP addresses in the following way -

iptables -A FORWARD -t mangle -s 123.2.3.4 -j MARK --set-mark 1

How to mark packets depending on the hostname? I tried this -

iptables -A FORWARD -t mangle -s google.co.in -j MARK --set-mark 1

But the iptables utitlity gets the IP address of google.co.in from the DNS and adds the entry to the mangle table. How to mark all the packets from google.co.in, and not just from the single server of Google. As there are thousands of servers, manually adding all IP addresses is also not possible.

Is there any way to read the packet and get the hostname and mark it?

Thank you.

bgtvfr
  • 1,262
  • 10
  • 20
cold_coder
  • 59
  • 2
  • 2
    You cannot inspect all packets (think: TLS) & you cannot obtain a full list of Google IPs used for this domain anyway. Rather explain the original problem you are attempting to solve with iptables here, other strategies may be viable. – anx Jan 09 '17 at 16:19

2 Answers2

6

Firewall rules do not operate at the DNS level. In some cases iptables will do a DNS resolution for you, but the result will not be what you are looking for and will not follow and IP changes in the DNS name.

Instead you need a HTTP proxy such as Squid and its Outgoing Packet Mark (http://www.squid-cache.org/Doc/config/tcp_outgoing_mark/) feature to handle this kind of behavior.

For incoming traffic, if you are particularly interested in GoogleBot, you could look at the unofficial IP range lists such as https://evert.meulie.net/faqwd/googlebot-ip-ranges/ and set up your iptables for that.

Jason Martin
  • 5,023
  • 17
  • 24
  • 1
    Google specifically punishes sites trying to fool the bot, so there likely isnt any use case for trying. – anx Jan 15 '17 at 21:13
  • One might want to segregate bot traffic to a sacrificial cluster. I would be helpful if the poster elaborated on _why_ they want to do this. – Jason Martin Jan 16 '17 at 00:27
3

" As there are thousands of servers, manually adding all IP addresses is also not possible. "

You can build and maintain a small list of all google AS, and then add firewall rules based on these network ranges.

Maybe you can even find all google AS on the internet.

(have a look at

Community
  • 1
bgtvfr
  • 1,262
  • 10
  • 20