IPTABLES to IPFW for Packet Inspection Filtering

[vladone]

Hello Daniel,

Thursday, April 27, 2006, 9:13:02 PM, you wrote:

> hey all,

> here's what I'm looking to do.  I know it could be done with IPTABLES, but
> as it's not available for the Mac OS X I'm trying to figure out how it
> would be done in IPFW ...

> RELAY is a workstation forwarding packets from a SOURCE workstation to all
> DESTINATION end points.  RELAY is able to receive all packets from SOURCE
> bound to DESTINATION.  I want RELAY to deny packets forwarding from SOURCE
> that are name resolution attempts to DESTINATION DNS server specifically
> for host WWW.YAHOO.COM (for example).  To do this I need to create a rule
> that will look into the Data field of an DNS packet and match the query.
> The Data field of a DNS query packet would be written in hex. 

> With IPTABLES I would write something like this:

> RELAY #  iptables -I FORWARD 1 -p udp --dport 53 -m string --hex-string
U have in man ipfw explanation for this.

src and dst: {addr | { addr or ... }} [[not] ports]
             An address (or a list, see below) optionally followed by ports
             specifiers.

             The second format ( or-block with multiple addresses) is provided
             for convenience only and its use is discouraged.

     addr: [not] {any | me | addr-list | addr-set}

     any     matches any IP address.

     me      matches any IP address configured on an interface in the system.
             The address list is evaluated at the time the packet is analysed.

     addr-list: ip-addr[,addr-list]

     ip-addr:
             A host or subnet address specified in one of the following ways:

             numeric-ip | hostname
                     Matches a single IPv4 address, specified as dotted-quad
                     or a hostname.  Hostnames are resolved at the time the
                     rule is added to the firewall list.

So if u want to deny packets from some hostname u have an rule like:
ipfw add 100 deny ip from me to www.hahoo.com


-- 
Best regards,
 vladone                            mailto:vladone at spaingsm.com