3

Want to block this URL STRING with IPTABLES. Need to know specific command.

"GET /affiliate/5/campaigns?api_key=duO5gVw3s0&affiliate_id=67647&format=json HTTP/1.0" 404 785 "-" "Dalvik/1.6.0 (Linux; U; Android 4.4.4; XT1032 Build/KXB21.14-L1.40)"

Want to use this to block it. I just want to block the URL path. Its not working though any tips?

iptables -A INPUT -m string --algo bm --string "GET /affiliate/5/campaigns?api_key=duO5gVw3s0&affiliate_id=67647&format=json" -j DROP
FATAL: Could not load /lib/modules/2.6.32-042stab108.1/modules.dep: No such file or directory 
11
  • That should work. Is this request definitely over http and not https?
    – Paul
    Jun 2, 2015 at 23:39
  • Its HTTP. I am seeing this [root@host logs]# iptables -A INPUT -m string --algo bm --string "GET /affiliate/5/campaigns?api_key=duO5gVw3s0&affiliate_id=67647&format=json" -j DROP FATAL: Could not load /lib/modules/2.6.32-042stab108.1/modules.dep: No such file or directory
    – john
    Jun 2, 2015 at 23:41
  • I would check the packet contents with wireshark and check iptables -L and make sure the strings match exactly. If they do, then consider starting with a shorter string to make sure the principle works, then extending it to see where it stops working. Also make sure there isn't an earlier rule in iptables that is permitting the traffic and bypassing this rule.
    – Paul
    Jun 2, 2015 at 23:48
  • Ah. That error means my previous comment doesn't help
    – Paul
    Jun 2, 2015 at 23:49
  • Is there another line after the FATAL error? It should tell us what is missing - check dmesg if not.
    – Paul
    Jun 2, 2015 at 23:51

1 Answer 1

1

As you can see from the error message, you miss the modules.dep file, which prevents the automatic loading of the xt_string module. You can try to remedy this by running depmod -a; if that fails too, then you're likely missing the modules for your current kernel version, so you should install them. You can also try inserting the module manually, by running insmod /lib/modules/2.6.32-042stab108.1/kernel/net/netfilter/xt_string.ko.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .