iptables with regex url matching - regex

Question

What I need to achieve
I need count how many users open correct websites and sub websites
e.g. `http://stackoverflow.com'
'https://stackoverflow.com/questions'
What I have
router set on Centos 7
Iptables
https://github.com/xnsystems/kpcre/wiki/iptables-string-regex
I can't use squid.
this count system can't change IP headers (src and dst IP address)
that is why I need count use iptables with log option
or maybe there is software which will count urls without any packet modification
Problem
I can't find a way in which I will see how many IP adress (how many users) hit correct url
My iptables row looks like this and doesn't work
I mean match all urls (with all sub urls) not only http://stackoverflow.com
sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string "^http://stackoverflow.com$" --algo regex -j ACCEPT
Please help me with this case.
UPDATE:
Below three examples please try make them works
sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string stackoverflow.com --algo regex -j ACCEPT
sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string stackoverflow.com/documentation --algo regex -j ACCEPT
sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string stackoverflow.com/questions'; --algo regex -j ACCEPT
As you see I used --algo regex.
If you know another solution without it please suggest.

Answer 1

I checked the specification link, it is not very complete (e.g. \bseems know, but is not explained), but I think the regex you need is:
^(http:\/\/){0,1}[a-zA-Z0-9_-]+(\.[a-zA-Z0-9_-]+)+(\/[a-zA-Z0-9_-]+){0,}$
UPDATE: Allow http://prefix and /documentation suffix.
Please try.
The use of capture groups () is not specified, but that usually works.
If you give examples which match and should not or do not match and should, I will adapt this answer.
The easiest adaptation is to insert more characters (to be allowed for the URL) between the [a-zA-Z0-9_and the -], in two places.

Answer 2

The line that includes the URL in the packet has not only the URL but also some extra keywords around it.
If you want to block "http://stackoverflow.com" only, then you should specify the URL like this:
iptables -I OUTPUT -p tcp --dport 80 -m string --string "/\/ .+Host: stackoverflow.com/si" --algo regex -j DROP
or if you want to block "http://stackoverflow.com/questions" only, then you should specify the URL like this:
iptables -I OUTPUT -p tcp --dport 80 -m string --string "/\/questions .+Host: stackoverflow.com/si" --algo regex -j DROP