You can poll this FD for readability and call run(False) every Get the file descriptor of the socket used to receive queued Packets matched by your iptables rule will be dropped. Sock_len sets the receive socket buffer size. The source and destination IPs of a IPv4 packet, range could be 20. How many bytes of the packet you want to get. mode determines how much of the packetĭata is provided to your script. Of packets that can be in the queue new packets are dropped if the size of Rule, but there is no ordering requirement: it’s fine to either bind()Ĭallback is a function or method that takes oneĪrgument, a Packet object (see below). It must match the -queue-num in your iptables NetfilterQueue.bind(queue_num, callback, max_len=1024, mode=COPY_PACKET, range=65535, sock_len=.)Ĭreate and bind to the queue. Configure your queue withĪ call to bind, then start receiving packets with a call to run. NetfilterQueue objectsĪ NetfilterQueue object represents a single queue. Script: nothing, metadata, or the whole packet. These constants specify how much of the packet should be given to the API NetfilterQueue.COPY_NONE, NetfilterQueue.COPY_META, NetfilterQueue.COPY_PACKET To install from source: pip install cython To install from PyPI by pip: pip install NetfilterQueue From source On Debian or Ubuntu, install these files with: apt-get install build-essential python3-dev libnetfilter-queue-dev From PyPI Libnetfilter_queue development files and associated dependencies NetfilterQueue is a C extention module that links against libnetfilter_queue. To send packets destined for your LAN to the script, type something like: iptables -I INPUT -d 192.168.0.0/24 -j NFQUEUE -queue-num 1 Installation S = omfd(nfqueue.get_fd(), socket.AF_UNIX, socket.SOCK_STREAM) from netfilterqueue import NetfilterQueue You can also make your own socket so that it can be used with gevent, for example.

The following script prints a short description of each packet before accepting The last version with support for Python 2.7 was 0.9.0. The current version of NetfilterQueue requires Python 3.6 or later. Libnetfilter_queue (the netfilter library, not this module) is part of the Packets so matched can be accepted, dropped, altered, reordered, NetfilterQueue provides access to packets matched by an iptables rule in

Python3 queue