For testing reasons I would like to block specific packets depending on their options or type.For example in a DHCP DORA transaction I would like to block DHCP ACK packets only.Is it possible to do this using iptables ? If not , what are the possibilities ?
DROP a packet depending on it's options or type
linux;networking;iptables
You could use the u32 module. (See the manpage for iptables-extensions). It's not too user-friendly but should be usable.DHCP is a bit difficult to parse also because parts of the data, including the DHCP message type are in the options, which can be in arbitrary order. Though the message type option is likely to be the first one. The DHCP options start at offset 236 in the UDP packet, and the IP and UDP headers are 20+8 bytes long.  So we are interested in the bytes starting at offset 264. The first four bytes should be the magic identifier, and the next three can be checked for the message type option. The type code is 0x35, the length is always 0x01 and for DHCPACK the value is 0x05. (The DHCP packet format is described e.g. on tcpipguide.com) So the expression for u32 could be:--u32 '268 >> 8 = 0x350105'Which simply means to read 4 bytes at offset 268 (as big-endian number), shift them 8 bits to the right (to keep the first three bytes), and compare that to the expected value.We could check the magic number too:--u32 '264 = 0x63825363 && 268 >> 8 = 0x350105'Checking that we actually have a UDP packet going to correct port is easier to do with regular iptables rules, so we'd use something like the following to match the expected DHCP packets.iptables -A foo -m udp --dport bootpc -m u32 --u32 '264 = 0x63825363 && 268 >> 8 = 0x350105'Though, as said, the DHCP options could be in any order, so this isn't a robust method, especially if someone actively tries to work around it. But perhaps for testing it could do. Also, I assumed the IP header doesn't contain any options.