How to allow a single domain name with iptables
I am looking for a way to make iptables only accept requests for my domain name and reject the others.
Lately I misconfigured my apache proxy, it is now fixed, but I keep receiving a load of requests looking like that :
xxxx.xx:80 142.54.184.226 - - [12/Sep/2012:15:25:14 +0200] "GET http://ad.bharatstudent.com/st?ad_type=iframe&ad_size=700x300§ion=3011105&pub_url=${PUB_URL} HTTP/1.0" 200 4985 "http://www.gethealthbank.com/category/medicine/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0)"
xxxx.xx:80 199.116.113.149 - - [12/Sep/2012:15:25:14 +0200] "GET http://mobile1.login.vip.ird.yahoo.com/config/pwtoken_get?login=heaven_12_&src=ntverifyint&passwd=7698ca276acaf6070487899ad2ee2cb9&challenge=wTBYIo2AEdMFr6LtdyQZPqYw9FS9&md5=1 HTTP/1.0" 200 425 "-" "MobileRunner-J2ME"
which I would like to block.
How can I manage this ?
iptables (network-layer firewalling) is the wrong place to block these requests. It's very hard to make application-level filtering decisions at layer 3, and usually an unreliable hack at best even if you manage it. Look up "layering violation".
I see from the web server logs that those two requests are being answered with 200 status codes, which means they're being accepted and processed. You should configure your HTTP proxy server to refuse them. I see that you have already asked how to do that.