abakash Posted February 12, 2007 Share Posted February 12, 2007 Hi, I am working on a firewall and need to capture packets from the ethernet and then do some analysis on it before sending it to Apache application. I am been able to capture the packets but they are also received by the Apache at the same instant. But I need to analyze the packet before it is received by apache. Any help in this regard would be highly appreciated. Abakash Quote Link to comment Share on other sites More sharing options...
trq Posted February 12, 2007 Share Posted February 12, 2007 Are you writting the firewall using iptables? Quote Link to comment Share on other sites More sharing options...
steviewdr Posted February 12, 2007 Share Posted February 12, 2007 Im not sure you can do it - as you said - apache gets the packet at the same instant. Iptables would be a better level to go down to, but Im not sure if it has enough low level detail that you are looking for. Why do you want to analyse the visitor before it hits apache? I suggest you use a proxy which can hand off the request to a certain webserver on a local port etc. Is this for ssl certs etc.? -steve Quote Link to comment Share on other sites More sharing options...
abakash Posted February 13, 2007 Author Share Posted February 13, 2007 Actually what I am trying to do is, running a Web Application Firewall(WAF) and the Apache server on the same system on the same port(80). So, when a packet comes, it needs to be analyzed by the WAF before passing it to the Apache server module. But being running on the same port, packet is received by both at the same instant. Which is not at all helping my cause. I am stuck and don't know how to proceed. Any help would be great!!!! Quote Link to comment Share on other sites More sharing options...
steviewdr Posted February 13, 2007 Share Posted February 13, 2007 I think you need to look at mod_security which plugs into apache as a module. -steve Quote Link to comment Share on other sites More sharing options...
trq Posted February 13, 2007 Share Posted February 13, 2007 One solution would be to have Apache listen on a different port. When a request comes in for port 80, have your firewall inspect it and then if valid forward it to whatever port Apache is running on. Quote Link to comment Share on other sites More sharing options...
abakash Posted February 13, 2007 Author Share Posted February 13, 2007 Ya, I was thinking about it. But, I am not sure how easily I can forward the packet to another port? I felt i would need to store the packet, then modify the port number in the packet and then forward it. Can this work? Can u help me with some tutorial with how the packet can be stored and then modified? or is there any better way of doing it? Thanks Abakash Quote Link to comment Share on other sites More sharing options...
trq Posted February 13, 2007 Share Posted February 13, 2007 I really can't see a solution at the level you are attempting to do this. IMO you would need to use iptables and get this done well before you get to the webserver stage. Iptables is a huge subject in itself, there is a simple tutorial here but really, Id'e find a decent sys admin. Quote Link to comment Share on other sites More sharing options...
steviewdr Posted February 13, 2007 Share Posted February 13, 2007 If your using any decent Web Application Firewall(WAF) - it'll have an integration how-to for apache. -steve Quote Link to comment Share on other sites More sharing options...
abakash Posted February 13, 2007 Author Share Posted February 13, 2007 Actually I am making the firewall!!!!!! So, kind of need to know how to integrate!!!!! Quote Link to comment Share on other sites More sharing options...
trq Posted February 13, 2007 Share Posted February 13, 2007 Actually I am making the firewall!!!!!! What are you making the firewall with? Not PHP? A firewall should be well before a web server. read the link I posted about iptables, you use iptables to build firewalls. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.