[Discuss] iptables string matching is aggressive

[J B]

Dear list,

I like to force some sites to be available through our  squid proxy . So I have added the following at iptables at gateway server


iptables -I  FORWARD  -m string --algo bm --string "example.domain.com" \
       -p tcp  -j DROP

But this rule even block the site when using proxy.

So I have negate with the IP address of the proxy like this

iptables -I  FORWARD ! -d xx.xx.xx.xxx -m string --algo bm --string "example.domain.com" \ 
 -p tcp  -j DROP

Now the site is only accessible through the proxy having IP  xx.xx.xx.xxx

But two more issues with this settings as side effect.

1]  can't log into the backend panel of the site with this rule. Though login is possible with
same proxy if comment the iptable rule. Ajax call is associated with the backend login.

2] any site which match the string   "example"  out of  "example.domain.com" is blocked by this
rule automatically and this should not happen

Is there any way to fix these ?