iptables - create a rule to filter URL and schedule it with cron

[wooolf]

Dear All,

I want to manage my time more efficiently so I want to create simple rule to block specyfic domain, netflix.com for example.
After that I want to create a schedule to disable rule in selected time range.
In the first place I tried to create a rule at least and I did this in two different ways.

1. Added a rule manually. Steps:
   1. Create and add rule
      

      iptables -I FORWARD -p tcp -m webstr --url netflix.com -j REJECT --reject-with tcp-reset
      iptables -I FORWARD -i br0 -p udp -m udp --dport 53 -m string --string "netflix.com" --algo bm --to 65535 --icase -j DROP
      iptables -I INPUT -i br0 -p udp -m udp --dport 53 -m string --string "netflix.com" --algo bm --to 65535 --icase -j DROP

   2. Check access - netflix is still avalible
2. Added a rule via GUI (Firewall - URL Filter) and export iptables config.
   1. Export iptables config before adding any rule (to have clear config)
      

      ipconfig-save > open_url.txt

   2. Added rule
      
      
   3. Checked access - netflix is blocked
   4. Export iptables config (to have config with blocked url)
      

      iptables-save > blocked_url.txt

   5. Import open_url.txt
      

      iptables-restore < open_url.txt

   6. Check access - netflix is open
   7. Import blocked_url.txt
      

      iptables-restore < blocked_url.txt

      ERROR
      
      

I assume that the last error is because ASUS is created this black list somewere, which is of course not a part of iptables config.

Best regards

 

[dave14305]

It’s an Asus iptables-save bug that was fixed in Merlin firmware a couple years ago.

 

[wooolf]

It's strange because I don't have so old firmware. RT-AX88U is also not so old hardware.
However I don't have the latest firmware version so I can update it and the retest iptables-save.

 

[dave14305]

It's strange because I don't have so old firmware. RT-AX88U is also not so old hardware.
However I don't have the latest firmware version so I can update it and the retest iptables-save.

I don’t think they really planned on users using iptables-save, so it’s an uncommon situation on stock firmware.

 

[wooolf]

Maybe someone knows how to deal with such a situation in a different way?

 

[dave14305]

Maybe someone knows how to deal with such a situation in a different way?

You can edit the blocked_url.txt file to correct the error in the iptables-save output. The original -m webstr --url will incorrectly look like -m webstr--webstr

Post the actual line in the file if you can’t get it to work.

 

[wooolf]

I checked it and it works. Many thanks!