reject tcp any any -> any any (msg: "Bad keyword detected!"; content: "ultrasurf"; http_uri; sid: 1;)