Re: Trying to achieve fail over to multiple DNATed destinations

["Tyler J. Wagner" <tyler@tolaris.com>]

On 2011-08-09 20:57, Grant Taylor wrote:
> On 08/08/11 17:36, Mark Ruth wrote:
>> The problem is that the target webserver (i.e. www.example.com ) is
>> loadbalanced between like 10 servers having 10 public IPs (which are
>> NOT in series), but since IPtables can not accept domain names
>> (correct me if i m wrong) I have to select 1 ip address (i.e.
>> 201.23.11.22 ) from the pool of 10 available, for my iptables rule.
> 
> It is my (mis)understanding that the iptables command will accept host
> names and resolve them to an IP which is inserted in to the kernel.  So,
> you are close.

Yes, it will. However, this will make loading your firewall rules block
on DNS. If you are loading the firewall as the interface comes up, that
may be a problem for you. For critical systems, especially routers, I
use only IP addresses in the firewall script.

Regards,
Tyler

-- 
"No one can terrorize a whole nation, unless we are all his accomplices."
   -- Edward R. Murrow