How can I block HTTPS application data by using iptables?

Question

I want to block a HTTPS connection after TLS handshake using Iptables. In the other words, I want to allow TCP and TLS handshakes, and then I want to drop the connection. I know that HTTPS is encrypted, but there may be a solution to differentiate TLS handshake packets and application data packets without decrypting them.

Answer 1

您只需要从端口443接受SYN，SYN / ACK，ACK数据包以允许握手，然后丢弃其余数据包： iptables -A INPUT --protocol tcp --tcp-flags SYN ACK --dport 443 -j ACCEPT iptables -A INPUT --protocol tcp --tcp-flags FIN RST URG PSH --dport 443 -j DROP