gdelugre / ruby-nfqueue Goto Github PK

nfqueue is a tiny wrapper around libnetfilter_queue. It allows you to do some packet filtering very simply in a Ruby environment.

For example, plugging on the #0 queue:

require 'nfqueue'

Netfilter::Queue.create(0) do |packet|
  puts "Inspecting packet ##{packet.id}"

  p packet.data
  Netfilter::Packet::ACCEPT
end

This is an example for intercepting outgoing HTTP traffic:

iptables -A OUTPUT -p tcp --dport 80 -j NFQUEUE --queue-num 0 --queue-bypass

You need to have kernel support for NFQUEUE and libnetfilter_queue installed to get it working. nfqueue depends on nfnetlink and ffi (https://github.com/ffi/ffi/wiki/)

Guillaume Delugré, guillaume at security-labs dot org