iptables Block Direct IP Access to HTTPS

[Marks-Man]

- Convert IP Address to Hex Format

Ex: 127.0.0.1

7f.00.00.01 (0x7f000001)

Replace string : "|7d 00 00 01|"

IP to Hex Converter - Convert IP to Hexadecimal - Online - Browserling Web Developer Tools

Useful, free online tool that converts an IP address to hex. No ads, nonsense, or garbage, just a hex IP converter. Press a button – get the result.

www.browserling.com

Add the following rule to "Filter" Table:

-I INPUT -p tcp -m tcp  --dport 443 -m string --hex-string "|7d 00 00 01|" --algo kmp --to 65535 -m string --string "/" --algo bm --to 65535 -j DROP

service iptables restart

Note: Websites hosted on this IP will keep working, but anyone who tries to access IP directly will be blocked !!

 

[RankBit]

On Port 80 doesn't need Hex string to be added otherwise virtual host will not be accessible from domain

-I INPUT -p tcp -m tcp  --dport 80 -m string --hex-string "127.0.0.1" --algo kmp -j DROP

 

[Marks-Man]

On Port 80 doesn't need Hex string to be added otherwise virtual host will not be accessible from domain

-I INPUT -p tcp -m tcp  --dport 80 -m string --hex-string "127.0.0.1" --algo kmp -j DROP

Thank you for mentioning that

 

[Marks-Man]

@RankBit
It should be

-I INPUT -p tcp -m tcp  --dport 80 -m string --hex-string "Host: 127.0.0.1" --algo kmp -j DROP