[SOLVED] iptables string module

bonnydeal · 09-10-2015, 05:43 AM

Hi

I am using the same iptables rules on 2 different linux installations:

1. centos 5 / 2.6.18-400.1.1 iptables v1.3.5
2. centos 6 / 2.6.32-504.3.3 iptables v1.4.7

rules

Code:

-A INPUT -p tcp -m tcp --dport 80 -j FW-Web-1 
...
-A FW-Web-1 -m string --string "GET /w00tw00t" --algo bm --to 70 -j DROP
...

This is working fine on the centos 5 setup.
However on centos 6 the match does not work and the packet does not get dropped.

Any ideas?

Thanks in advance.

bonnydeal · 09-10-2015, 07:17 AM

In desperation i tried:

Code:

-A FW-Web-1 -m string --string "GET /w00tw00t" --algo kmp --to 70 -j DROP

... and it works.