9

:)

I'm wanting to be able to run a system command when an IPTable rule is hit, passing the IP address of the remote device to it.

I've had a look around but found nothing. I thought of grepping logs, but I'm expecting a lot of traffic..

Any help would be fantastic!

Thanks

(If it helps, Ubuntu Linux is my platform of choice)

AndyD
  • 105
  • 1
  • 6

3 Answers3

6

Here is how you do it:

iptables -I FORWARD -p tcp --dport 80 -d a.b.c.d -j LOG --log-prefix="TRIGGER ME NOW !!!"

tail -f some-logfile | awk '/some-pattern/ {system("run-some-command")}'

Should be straight forward enough and should be able to deal with lots of traffic, the tail command should be quick enough... Just make sure the file doesn't grow too much.

Yannick
  • 3,426
  • 1
  • 12
  • 6
2

Do it with knockd instead. You configure a port knocking sequence of just one port, then tell knockd the command you want to run. Normally it's used to add/remove iptables rules -- to open a service (e.g. ssh access) after a certain knock sequence, but I don't see why you couldn't just use it to run a command after a very simple, one packet on one expected port rule.

'apt-get install knockd' on your Ubuntu system and the man page has examples you can easily adapt to this.

Craig Constantine
  • 161
  • 7
0

it is actually easy. we have 2 way to do this. If you use tail log then iptables will not depend on log result.

  1. you can use NFQUEUE. Please read my article if you have time. https://medium.com/@farizmuradov/useful-notes-about-nfqueue-80a2c271db1a Same article I have added my linkedin page.

  2. you can write simple router in application level and send data from iptables to listen port. In programming level you can execute scripts and send data again some port. Then you can continue by iptables.

aze2201
  • 453
  • 5
  • 12