Firewall with filtering like wireshark

Question

linux

Tell me if there is a firewall, for Linux, with a protocol analyzer. So that it would be possible to form rules like wireshark (in the sense with the same capabilities). For example, something like this:

firewall -A OUTPUT --rule="http.host==habrahabr.ru" -j DROP

Answer 1

There is. Look for "L7 filter".
PS: but you don’t need to cut off habrahabr.ru in the OUTPUT chain - the locals will not forgive you for this. :)

Answer 2

It is possible to cut by hosts in iptables extensions