root@ip-x:~/nfq_ndpi_firewall/src# ls /etc/xtables
connlabel.conf
root@ip-x:~/nfq_ndpi_firewall/src# iptables -I FORWARD -m connlabel ! --label NDPI_DETECTION_OVER -j NFQUEUE --queue-num 10
iptables v1.4.21: label 'NDPI_DETECTION_OVER' not found
Try `iptables -h' or 'iptables --help' for more information.

## Usage
You can start with running `./NdpiNfqueueFirewall --help`.
Normally you should start with copying [connlabel.conf](./connlabel.conf) file from this repository into `/etc/xtables/`.
Then there are two options you have: single-queue and multi-queue.

### Single queue
1. Run `./NdpiNfqueueFirewall`
2. In another terminal run `iptables -I FORWARD -m connlabel ! --label NDPI_DETECTION_OVER -j NFQUEUE --queue-num 10`. I'm not going to explain how N$

### Multiple queues (4)
1. Run `./NdpiNfqueueFirewall -n 4`
2. In another terminal run `iptables -I FORWARD -m connlabel ! --label NDPI_DETECTION_OVER -j NFQUEUE --queue-balance 10:13`

### Manipulating packets
After you have launched the program NdpiNfqFirewall will start labeling connections in connection tracking subsystem of Linux.

For example, you can run `iptables -I FORWARD -m connlabel --label FACEBOOK -j DROP` in case you want to drop packets coming from facebook web site.

1. Run `./NdpiNfqueueFirewall`

Configuration of this run is the following:
	number of queues 	 1
	number of roots 	 512
	maximum flows 		 200000000
	idle scan period 	 100
	maximum idle time 	 30000
	maximum idle flows 	 1024
	quiet 			 0
Main: creating thread 0
Queue 10: opening library handle
Queue 10: unbinding existing nf_queue handler for AF_INET (if any)
Queue 10: binding nfnetlink_queue as nf_queue handler for AF_INET
Queue 10: binding this socket to queue '10'
Queue 10: error during nfq_create_queue()

nohup ./NdpiNfqueueFirewall &
disown %1

=)