0

I have a device which I want to block some http requests. No my setup is

[Device] -- [Switch]

As the device is really simple I cannot block from it a request and I cannot modify the program in order to block the requests

What I want to do is

[Device] -- [PC] -- [Switch]

I am using Ubuntu 14.04 and my pc has two ethernet ports. I tried to find some answers on the internet but not so much luck on that.

Is there any way to do that? To pass my device through my pc and block specific http requests (like using fiddler) ?

  • There's many ways to do that, depending on the details of your situation. Read up on setting up Linux as a route, with or without NAT, and on iptables to block http requests, or on running a transparent proxy to block or modify just some requests. – dirkt Jun 6 '17 at 10:49
1

I would recommend a transparent proxy setup, too. This can be done in three steps.

  1. Squid configuration (so that it will act as a transparent proxy)
  2. Iptables configuration (configure system as router, then forward all http traffic to Squid)
  3. Use Squid ACLs to filter your http-request(s)

1. Squid config

Asuming that you are able to install squid and edit your squid.conf, this would be a simple (condensed) sample to enable a transparent http proxy for the network 192.168.111.0/24 and *.222./24.

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.111.1 192.168.222.0/24
http_access allow localhost
http_access allow lan

2. Iptables setup

Your DNAT rules would then look like this, asuming that the squid service is running on the default port (3128).

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.1.1:3128
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

3. Squid ACLs

Your sample ACL may look like this. Just use the fitting Access Controls for your case.

acl evelrequest url_regex -i ^http(s)://([a-zA-Z]+).hostname.tld/requestpath/.*$
http_access deny evelrequest
| improve this answer | |
  • I am trying that on a managed network. We need that to test some problems. But trying that creates a lot of problems. Is that possible to only bypass the connection from one port to another? There will be a machine only to do that. It will be used to control the flow of the network on some devices. – Lefsler Jun 7 '17 at 15:57
  • "But trying that creates a lot of problems." is not really helpful in helping you. "Is that possible to only bypass the connection from one port to another?" - Yes, that would be http on port 80 in this case. Or as many listeners (http_port) or as many ACLs (acl MyAcl ...) as you want. Squid would be nearly as transperent as a network cable. If I had to isolate just one hostÄs traffic, I would use a Squid ACL to do so. – bjoster Jun 25 '17 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.