* Re: host names and IPs
2003-04-18 11:57 host names and IPs Florian Effenberger
@ 2003-04-18 15:41 ` Joel Newkirk
2003-04-22 16:05 ` bill davidsen
1 sibling, 0 replies; 4+ messages in thread
From: Joel Newkirk @ 2003-04-18 15:41 UTC (permalink / raw)
To: Florian Effenberger; +Cc: netfilter
On Fri, 2003-04-18 at 07:57, Florian Effenberger wrote:
> Hi,
>
> I have a question to the gurus on this list ;-)
>
> I'm on Linux 2.4.20 with iptables 1.2.7a. I have a syntax as follows:
>
> ===
> iptables -A INPUT -p tcp -s www.myhostname.com --dport 53 -j ACCEPT
> ===
>
> Now it seems that www.myhostname.com is resolved only the first time the
> rule is set and that a fixed IP address is stored.
Correct.
> However, www.myhostname.com has a dynamically assigned address and I would
> like to have iptables resolve the IP address everytime.
Same here... :^(
> Is that possible? If yes, how? Or will it produce too much load?
Iptables/netfilter does not, AFAIK, support this at all. I have a
similar situation, and found two solutions.
The one I implemented was to map out the range of dynamic IPs assigned
(ISP refused to disclose!) and ended up using a /22 netmask. Not as
tight, but simpler and less overhead than:
The other approach was to write a script (cron scheduled) that would
extract the IP from 'dig' output and compare it against a stored value
from the last change (/tmp/myhostname.com.ip perhaps). If the same do
nothing. If different, delete the original rule, insert a
newly-constructed one, and echo the new IP to the tmp file. Depending
on the lease-length (or whatever other factor may determine lifespan of
a given IP for www.myhostname.com...) and frequency of expected
connections, you'd set the frequency of the job accordingly.
Depending on what services are being made available to
www.myhostname.com, the first solution is probably your best bet so long
as it doesn't open up anything critical. For my case, the rule only
opens SSH, and only a single non-root user can login with SSH on that
box. (and all SSH access is logged)
The third solution, of course, would be to dig into the source and write
a new match, or patch the "-s" match with a new flag like "--dynip" and
the obvious support to enable that... ;^) Checking the current IP of a
named host for every packet would be impossible. The only feasible
solution here would be to integrate the effect of the cron job approach
into the netfilter code, periodically confirming the IP and updating if
needed.
> Thanks
> Florian
j
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: host names and IPs
2003-04-18 11:57 host names and IPs Florian Effenberger
2003-04-18 15:41 ` Joel Newkirk
@ 2003-04-22 16:05 ` bill davidsen
2003-04-22 20:11 ` Michael K
1 sibling, 1 reply; 4+ messages in thread
From: bill davidsen @ 2003-04-22 16:05 UTC (permalink / raw)
To: netfilter
In article <003301c305a1$c04ab1a0$0500a8c0@effenberger>,
Florian Effenberger <floeff@arcor.de> wrote:
| I'm on Linux 2.4.20 with iptables 1.2.7a. I have a syntax as follows:
|
| ===
| iptables -A INPUT -p tcp -s www.myhostname.com --dport 53 -j ACCEPT
| ===
What is it you're trying to do here? A packet with your source address
would be going through the OUTPUT table, no? An INPUT packet with your
own IP would be spoofed. Are you trying to accept DNS requests from
yourself, in tcp (instead of normal udp) mode?
| Now it seems that www.myhostname.com is resolved only the first time the
| rule is set and that a fixed IP address is stored.
|
| However, www.myhostname.com has a dynamically assigned address and I would
| like to have iptables resolve the IP address everytime.
|
| Is that possible? If yes, how? Or will it produce too much load?
There are several ways to re-resolve it, but I'm not clear on why you
don't just specify by interface.
How about some clarification on what you're trying to do, rather than
how you want to do it?
--
bill davidsen <davidsen@tmr.com>
CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.
^ permalink raw reply [flat|nested] 4+ messages in thread