L7简单应用

禁止sina字符串
iptables -I FORWARD -s 192.168.2.0/24 -m string --string "sina" -j DROP

某IP周一到周五 上8点下6点可以访问web
iptables -I FORWARD -s 192.168.2.3 -m time --timestart 8:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT

阻止bit
iptables -t mangle -A POSTROUTING -m layer7 --l7proto bittorrent -j DROP

阻止msn
iptables -t mangle -A POSTROUTING -m layer7 --l7proto msnmessenger -j DROP

阻止qq
iptables -t mangle -A POSTROUTING -m layer7 --l7proto qq -j DROP

阻止雅虎通
iptables -t mangle -A POSTROUTING -m layer7 --l7proto yahoo -j DROP

阻止socks代理
iptables -t mangle -A POSTROUTING -m layer7 --l7proto socks -j DROP

阻止CS
iptables -t mangle -A POSTROUTING -m layer7 --l7proto counterstrike -j DROP

限制bt协议的带宽
iptables -t mangle -A POSTROUTING -m layer7 --l7proto imap -j MARK --set-mark3
tc filter add dev eth0 protocl ip parent 1:0 prio handle 3 fw flowid 1:3