On Sat, 2020-09-12 at 17:45 +0200, david@xxxxxxxxx wrote: > sounds like Layer-7 filtering. > > There is something similar what you seek > < > https://serverfault.com/questions/998962/nftables-support-string-matching-support> > That indeed looks like what I'm trying to do. I fiddled around with it, but it's very different than the iptables method of simply provide a filter for a string and iptables will parse headers for it and block anything that matches. I tried it with nftables, by putting this in there for the output chain on my laptop: chain output { ct state invalid drop meta l4proto tcp @th,160,128 0x0970726f787970697065036e657400 counter drop comment "block queries for proxypipe.net" type filter hook output priority 0; policy accept; oifname "lo" accept ip6 daddr $ipv4_rfc3964 log prefix "6TO4_REJECT: " counter reject with icmpv6 type addr-unreachable comment "Reject 6to4 (RFC3964)" } But it doesn't block anything in Chrome when I visit proxypipe.net. And I'm just guessing at this point because these nftable options are way more complex than iptables. The example from server fault is about blocking DNS UDP requests to that website. But what I want to do is block web requests. Which worked fine for Facebook with iptables. And was easy to setup. Could someone guide me towards the right direction? Simply blocking DNS requests won't cut it, since I want to deny the website on specific days and time ranges. If facebook.com is still in the DNS cache, it will load the website. I have my own (unbound) recursive resolver, so blocking Facebook entirely is no issue in terms of a DNS block. But the thing is, I sometimes would like to allow Facebook on a firewall level. That way I can enforce it for my phone via VPN as well. There are apps for this as well. And Android has something builtin to limit website visit time with Digital Wellbeing. But I prefer to have this central solution. Any suggestions or more specific examples for this use case?
Attachment:
signature.asc
Description: This is a digitally signed message part
