Имеем набор правил для Suricata:
pass tcp any any <> any any (content: "GET /d/247048.html";content: "Host: memo.ru"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:10;)
pass tcp any any <> any any (content: "GET /d/247048.html";content: "Host: www.memo.ru"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:11;)
pass tcp any any <> any any (content: "GET /news/286782/rossiya_ustroila_ocherednuyu_provokatsiyu_na_granitse_s_ukrainoyi_mid";content: "Host: censor.net.ua"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:12;)
pass tcp any any <> any any (content: "GET /news/286782/rossiya_ustroila_ocherednuyu_provokatsiyu_na_granitse_s_ukrainoyi_mid";content: "Host: www.censor.net.ua"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:13;)
pass tcp any any <> any any (content: "GET http://memo.ru/d/247048.html";content: "Host: memo.ru"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:20;)
pass tcp any any <> any any (content: "GET http://www.memo.ru/d/247048.html";content: "Host: www.memo.ru"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:21;)
pass tcp any any <> any any (content: "GET http://censor.net.ua/news/286782/rossiya_ustroila_ocherednuyu_provokatsiyu_na_granitse_s_ukrainoyi_mid";content: "Host: censor.net.ua"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:22;)
pass tcp any any <> any any (content: "GET http://www.censor.net.ua/news/286782/rossiya_ustroila_ocherednuyu_provokatsiyu_na_granitse_s_ukrainoyi_mid";content: "Host: www.censor.net.ua"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:23;)
#pass tcp any any <> any any (content: "Firefox/40.0";replace: "Firefox/35.0"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x6/0xffffffff; sid:10202;)
#pass tcp any any <> any any (content: "GET http://";content: "Host: ";content: "HTTP"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:10200;)
pass tcp any any <> any any (pcre: "/\n/i"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x8/0xffffffff; sid:10208;)
#pass tcp any any <> any any (content: "CONNECT ";content: "HTTP"; msg: "PROXY_METHOD_GET"; nfq_set_mark:0x2/0xffffffff; sid:10204;)
root@debian:/home/admin#
iptables:
root@debian:/home/admin# iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 457K packets, 595M bytes)
pkts bytes target prot opt in out source destination
621K 627M NFQ_DV all -- any any anywhere anywhere
500K 604M REMARK_BL all -- any any anywhere anywhere
Chain INPUT (policy ACCEPT 2228 packets, 152K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 454K packets, 595M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 2751 packets, 369K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 457K packets, 595M bytes)
pkts bytes target prot opt in out source destination
Chain NFQ_DV (1 references)
pkts bytes target prot opt in out source destination
392K 582M RETURN all -- any any anywhere anywhere connbytes 1000000 connbytes mode bytes connbytes direction both
121K 24M NFQUEUE all -- any any anywhere anywhere mark match ! 0x1/0x1 NFQUEUE num 0 bypass
Chain REMARK_BL (1 references)
pkts bytes target prot opt in out source destination
154 46929 CONNMARK all -- any any anywhere anywhere mark match 0x2/0xfe CONNMARK save
19 16502 CONNMARK all -- any any anywhere anywhere mark match 0x8/0xfe connmark match 0x2/0xfe CONNMARK xset 0x98/0xfe
238 70850 LOG all -- any any anywhere anywhere connmark match 0x2/0xfe LOG level warning prefix "DPI MARK 0x2/0xfe"
238 70850 CONNMARK all -- any any anywhere anywhere connmark match 0x2/0xfe CONNMARK restore
root@debian:/home/admin#
root@debian:/home/admin# iptables -L -v
Chain INPUT (policy ACCEPT 701 packets, 42762 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 443K packets, 637M bytes)
pkts bytes target prot opt in out source destination
61 61851 REJECT tcp -- any any anywhere anywhere connmark match 0x98/0xfe reject-with tcp-reset
Chain OUTPUT (policy ACCEPT 943 packets, 128K bytes)
pkts bytes target prot opt in out source destination
root@debian:/home/admin#
Если попытаться перейти на сайт, указанный в Suricata,то соединение начинает висеть на Ожидании ответа (браузер не получает синволы). Я провирял, если сервер пытается отправить ответ, ему отдают RST. Задача: отправить клиенту RST или поддельный ответ средствами iptables.
