Iptables controls IP access to the requested URL

The server running environment is Tomcat. The purpose is to allow only specific IP addresses to access a directory,

One way is to use RemoteAddrValve to control access to the VM in the tomcat configuration file server. conf.

You can also use iptables rules. I personally prefer iptables.

For example, to prohibit access to the path http: // 192.168.137.254: 10000/managersns, only access from 192.168.137.101 is allowed.

/Sbin/iptables-a input-I eth0-p tcp -- dport 10000-s 192.168.137.101-m string -- string "/managersns" -- algo bm-j ACCEPT/sbin/iptables- INPUT-I eth0-p tcp -- dport 10000-m string -- string "/managersns" -- algo bm-j DROP

/Sbin/iptables-a input-I eth0-p tcp -- dport 10000-s 192.168.137.101-m string -- string "/managersns" -- algo bm-j ACCEPT

/Sbin/iptables-a input-I eth0-p tcp -- dport 10000-m string -- string "/managersns" -- algo bm-j DROP

The preceding rule is for the eth0 Nic, which can be tracked and modified as needed.

Parameter description:

-M string

Use the string function. string is a module of iptables, that is, string matching.

-String "xxxx"

Define the string content, which can be any character in the URL. If you need to block some types of files or requests, this space is very large and can be imagined.

-Algo bm

Set the character matching query algorithm. Generally, you can use the bm algorithm by default. You can also set the kmp algorithm, which is a more complex algorithm, for more information, see advanced mathematics. (Bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)

-J DROP

This is very effective when video websites are disabled on the company's network. Set it on the gateway Server:

Iptables-a forward-m string -- string "ku6.com" -- algo bm-j DROP iptables-a forward-m string -- string "tudou.com" -- algo bm-j DROP iptables-A FORWARD -m string -- string "ououou.com" -- algo bm-j DROP

Iptables-a forward-m string -- string "ku6.com" -- algo bm-j DROP

Iptables-a forward-m string -- string "tudou.com" -- algo bm-j DROP

Iptables-a forward-m string -- string "ouou.com" -- algo bm-j DROP

The meanings of parameters are as follows:

-A FORWARD

Add the FORWARD chain rule. The preceding rule is for routing enabled (that is, echo 1 & gt;/proc/sys/net/ipv4/ip_forward)

For direct access, you can use INPUT or OUTPUT.

Set the handling method of packets that meet this condition. DROP means discard, which is also the meaning of reject.

Iptables-a input-m string -- string "stringname" -- algo bm-j DROP

Recommended reading:

Iptables-packet filtering (Network Layer) Firewall

Linux Firewall iptables

Iptables + L7 + Squid implements a complete software firewall

Basic use of iptables backup, recovery, and firewall scripts

Detailed description of firewall iptables usage rules in Linux