host names and IPs

host names and IPs

[Florian Effenberger]

Hi,

I have a question to the gurus on this list ;-)

I'm on Linux 2.4.20 with iptables 1.2.7a. I have a syntax as follows:

===
iptables -A INPUT -p tcp -s www.myhostname.com --dport 53 -j ACCEPT
===

Now it seems that www.myhostname.com is resolved only the first time the
rule is set and that a fixed IP address is stored.

However, www.myhostname.com has a dynamically assigned address and I would
like to have iptables resolve the IP address everytime.

Is that possible? If yes, how? Or will it produce too much load?

Thanks
Florian

Re: host names and IPs

[Joel Newkirk]

On Fri, 2003-04-18 at 07:57, Florian Effenberger wrote:
> Hi,
> 
> I have a question to the gurus on this list ;-)
> 
> I'm on Linux 2.4.20 with iptables 1.2.7a. I have a syntax as follows:
> 
> ===
> iptables -A INPUT -p tcp -s www.myhostname.com --dport 53 -j ACCEPT
> ===
> 
> Now it seems that www.myhostname.com is resolved only the first time the
> rule is set and that a fixed IP address is stored.

Correct.

> However, www.myhostname.com has a dynamically assigned address and I would
> like to have iptables resolve the IP address everytime.

Same here... :^(

> Is that possible? If yes, how? Or will it produce too much load?

Iptables/netfilter does not, AFAIK, support this at all.  I have a
similar situation, and found two solutions.

The one I implemented was to map out the range of dynamic IPs assigned
(ISP refused to disclose!) and ended up using a /22 netmask.  Not as
tight, but simpler and less overhead than:

The other approach was to write a script (cron scheduled) that would
extract the IP from 'dig' output and compare it against a stored value
from the last change (/tmp/myhostname.com.ip perhaps).  If the same do
nothing. If different, delete the original rule, insert a
newly-constructed one, and echo the new IP to the tmp file.  Depending
on the lease-length (or whatever other factor may determine lifespan of
a given IP for www.myhostname.com...) and frequency of expected
connections, you'd set the frequency of the job accordingly.

Depending on what services are being made available to
www.myhostname.com, the first solution is probably your best bet so long
as it doesn't open up anything critical.  For my case, the rule only
opens SSH, and only a single non-root user can login with SSH on that
box.  (and all SSH access is logged)

The third solution, of course, would be to dig into the source and write
a new match, or patch the "-s" match with a new flag like "--dynip" and
the obvious support to enable that... ;^)  Checking the current IP of a
named host for every packet would be impossible.  The only feasible
solution here would be to integrate the effect of the cron job approach
into the netfilter code, periodically confirming the IP and updating if
needed.

> Thanks
> Florian

j

Re: host names and IPs

[bill davidsen]

In article <003301c305a1$c04ab1a0$0500a8c0@effenberger>,
Florian Effenberger <floeff@arcor.de> wrote:

| I'm on Linux 2.4.20 with iptables 1.2.7a. I have a syntax as follows:
| 
| ===
| iptables -A INPUT -p tcp -s www.myhostname.com --dport 53 -j ACCEPT
| ===

What is it you're trying to do here? A packet with your source address
would be going through the OUTPUT table, no? An INPUT packet with your
own IP would be spoofed. Are you trying to accept DNS requests from
yourself, in tcp (instead of normal udp) mode?

| Now it seems that www.myhostname.com is resolved only the first time the
| rule is set and that a fixed IP address is stored.
| 
| However, www.myhostname.com has a dynamically assigned address and I would
| like to have iptables resolve the IP address everytime.
| 
| Is that possible? If yes, how? Or will it produce too much load?

There are several ways to re-resolve it, but I'm not clear on why you
don't just specify by interface.

How about some clarification on what you're trying to do, rather than
how you want to do it?
-- 
bill davidsen <davidsen@tmr.com>
  CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.

RE: host names and IPs

[Michael K]

What you could do is to create a crontab with the following bash script

--start---
#!/bin/bash
NEWIP=`host klintan.cjb.net | awk '{print $4}'`

if [ -f /etc/current_ip ]
then
        OLDIP=`cat /etc/current_ip`
else
        # 1st time run
        OLDIP="255.255.255.255/32"
fi

if [ "$NEWIP" != "$OLDIP" ]
then
        RULENUM=`iptables -L INPUT --line-numbers | grep "$OLDIP" | grep
"tcp dpt:domain" | awk '{print $1'}`
        if [ -z "$RULENUM" ]
        then
                iptables -A INPUT -p tcp -s $NEWIP --dport 53 -j ACCEPT
        else
                iptables -R INPUT $RULENUM -p tcp -s $NEWIP --dport 53
-j ACCEPT
        fi
        echo $NEWIP > /etc/current_ip
fi
--end---

But I'm sure that there are other (and better) ways

/Klintan

> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of 
> bill davidsen
> Sent: Tuesday, April 22, 2003 6:05 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: host names and IPs
> 
> 
> In article <003301c305a1$c04ab1a0$0500a8c0@effenberger>,
> Florian Effenberger <floeff@arcor.de> wrote:
> 
> | I'm on Linux 2.4.20 with iptables 1.2.7a. I have a syntax 
> as follows:
> | 
> | ===
> | iptables -A INPUT -p tcp -s www.myhostname.com --dport 53 -j ACCEPT 
> | ===
> 
> What is it you're trying to do here? A packet with your 
> source address would be going through the OUTPUT table, no? 
> An INPUT packet with your own IP would be spoofed. Are you 
> trying to accept DNS requests from yourself, in tcp (instead 
> of normal udp) mode?
> 
> | Now it seems that www.myhostname.com is resolved only the 
> first time 
> | the rule is set and that a fixed IP address is stored.
> | 
> | However, www.myhostname.com has a dynamically assigned 
> address and I 
> | would like to have iptables resolve the IP address everytime.
> | 
> | Is that possible? If yes, how? Or will it produce too much load?
> 
> There are several ways to re-resolve it, but I'm not clear on 
> why you don't just specify by interface.
> 
> How about some clarification on what you're trying to do, 
> rather than how you want to do it?
> -- 
> bill davidsen <davidsen@tmr.com>
>   CTO, TMR Associates, Inc
> Doing interesting things with little computers since 1979.
> 
>