From: <lists@sterenborg.info>
To: 'Netfilter' <netfilter@vger.kernel.org>
Subject: RE: Dynamic IP address in a rule?
Date: Mon, 27 Apr 2009 08:56:58 +0200 [thread overview]
Message-ID: <000a01c9c705$5c4c2db0$14e48910$@info> (raw)
In-Reply-To: <d39744a20904262346p41c1b5fcy2f754a9263d09df3@mail.gmail.com>
> > If iptables would have to perform a DNS lookup everytime a packet
> > passes, I think it would be terribly slow and probably not usable
> > for packetfiltering.
>
> Actually the DNS lookup is performed only once - in the time the
> ruleis inserted/appended. If the DNS returns more than one IP per
> name, a number of rules is inserted with each IP returned.
Yes, that's more or less what Jorge described. My point was that if the
Netfilter framework had to perform a DNS lookup for each (new?) packet
that it has to check, I think it would be quite slow (think about DNS
query timeouts, etc) and not so usable as it is now.
Grts,
Rob
next prev parent reply other threads:[~2009-04-27 6:56 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-04-25 12:12 Dynamic IP address in a rule? Paddie O'Brien
2009-04-26 19:43 ` Jorge Bastos
2009-04-26 22:38 ` Bruno Moreira Guedes
2009-04-27 8:30 ` Jorge Bastos
2009-04-27 8:52 ` Daniel Huhardeaux
2009-04-27 8:56 ` Jorge Bastos
2009-04-27 11:48 ` Pascal Hambourg
2009-04-27 6:41 ` lists
2009-04-27 6:46 ` Ivan Petrushev
2009-04-27 6:56 ` lists [this message]
2009-04-27 7:08 ` Ivan Petrushev
2009-04-27 13:23 ` Bruno Moreira Guedes
2009-04-27 11:57 ` Pascal Hambourg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='000a01c9c705$5c4c2db0$14e48910$@info' \
--to=lists@sterenborg.info \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox