Re: FQDN filtering

[InfoMail <infomail@nobarrier.co.za>]

this is the rule and below is the error .. is this ment to work

$IPTAB -A OUTPUT -p tcp -o eth0 -s 0/0 -d www.microsoft.com -j DROP
##$IPTAB -A FORWARD -s 0/0 -d www.microsoft.com -m state --state NEW -j DROP


starting rules for NATing
iptables v1.2.11: host/network `www.microsoft.com' not found
Try `iptables -h' or 'iptables --help' for more information.


Leonardo Rodrigues Magalhães wrote:

>
>    Well .... yes it can and no it cannot.
>
>    All rules can have FQDN instead of IPs. But FQDNs will be solved to 
> IPs and rules will be created using IPs.
>
> Rule:
> iptables -A INPUT -s www.microsoft.com -j DROP
>
> is completly valid, but will be translated to:
>
> iptables -A INPUT -s 207.46.198.30 -j DROP
> iptables -A INPUT -s 207.46.198.60 -j DROP
> iptables -A INPUT -s 207.46.199.30 -j DROP
> iptables -A INPUT -s 207.46.225.60 -j DROP
> iptables -A INPUT -s 207.46.18.30 -j DROP
> iptables -A INPUT -s 207.46.19.30 -j DROP
> iptables -A INPUT -s 207.46.19.60 -j DROP
> iptables -A INPUT -s 207.46.20.60 -j DROP
>
>    when you hit the ENTER key or execute your firewall script. You 
> will not see 'www.microsoft.com' if you do 'iptables -nL -v', you will 
> only see the translated IP addresses. If FQDN changes IP addresses, 
> iptables will not see that change because DNS query for searching IPs 
> is done only when the rule is created.
>
>    I think there's a limit on how many IPs iptables can handle for a 
> single FQDN, but I dont know what this limit is.
>
>    iptables seems to CANNOT have rules with FQDN and keep the FQDN 
> instead of IPs.
>
>    Anyway, filtering FQDNs seems to be nice on application level and 
> not always on IP level. Are you thinking on web filtering ??? Why not 
> using a http proxy (squid) for doing that ?? Are you thinking on SPAM 
> fighting ?? Why not using your MTA capabilities for that ??
>
>    Sincerily,
>    Leonardo Rodrigues
>
>
> rockey dada escreveu:
>
>> Is there any way one can use IPTABLES to filter traffic based on "Fully
>> Qualified Domain Names".
>>
>> Rgds
>>
>>  
>>


______________________________________
XamimeLT - installed on mailserver for domain @nobarrier.co.za
Queries to: postmaster@nobarrier.co.za