[Q]: Filtering based on reverse DNS

[Q]: Filtering based on reverse DNS

[Wayne McDougall]

What I want to achieve is to filter based on a reverse name lookup on a source (and ideally destination) IP on initiating a connection.

Why? Because I'm in a country (island) where communication within the country is very cheap, and communication outside is metered and expensive. So I'd like to be able to apply traffic shaping (quotas and rate limiting) and policing with different polices applying to whether the IP is in my country or outside. I understand that reverse DNS does not always work and I'm quite happy to treat anyone like that as being outside. But if there IP resolve to *.nz I want to treat them differently to everyone else.

I appreciate that this sort of requirement isn't likely to be found in the USA (where I suspect most of y'all are), and I suspect it may not be very common elsewhere (anywhere else?). So I will understand if there isn't much interest or support for this.

My questions are:
1. Is there anything already like this (or could be adapted)?
2. Are there reasons why I shouldn't be doing this at all. I appreciate that there would be a performance hit , and obviously I only want reverse DNS lookups when connections are initiated - I don't mind latency at that point, and obviously I should use a local caching nameserver. But is it all a real mess and I shouldn't go there? Why not?
3. If there is nothing out there, where should I attack this problem if I was going to try and roll my own? A netfilter module, right?


Thank you for your time. I am new to this, so please forgive (and feel free to correct) any inappropriate use of terminology.


Regards

Wayne McDougall

Re: [Q]: Filtering based on reverse DNS

[Athan]

[-- Attachment #1: Type: text/plain, Size: 1624 bytes --]

On Sat, Apr 12, 2003 at 07:24:42PM +1200, Wayne McDougall wrote:
> What I want to achieve is to filter based on a reverse name lookup on a source (and ideally destination) IP on initiating a connection.

  Doing this dynamically is going to get very hairy very quickly IMO.

  An alternative is to go via the whois info on the IP block an IP is
in.  A quick check on your own IP includes info about the APNIC
(Asia/Pacific NIC) registry at http://www.apnic.net/db/, looking a
little further on that page reveals:

	http://ftp.apnic.net/stats/apnic/

The latest file from there is:

	http://ftp.apnic.net/stats/apnic/apnic-2003-04-01

and the fields are explained at:

	ftp://ftp.apnic.net/pub/apnic/stats/apnic/_README-apnic-stats.txt

It should be possible to use this information to create a list of IP
blocks in CIDR notation that are assigned to NZ, and from that generate
a list of rules for firewalling/traffic shaping.
  Of course when dealing with a great number of rules like this you
should take the advice someone else offered which is to aggregate the
blocks into chunks, with top-level rules distinguishing between the
chunks jumping to chains that deal with smaller sub-chunks and so on
down to chains containing a few actual IP blocks.  This way you minimise
the number of rules traversed for any given block.

HTH,

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: [Q]: Filtering based on reverse DNS

[waltdnes]

On Sat, Apr 12, 2003 at 07:24:42PM +1200, Wayne McDougall wrote

> My questions are:
> 1. Is there anything already like this (or could be adapted)?
>
> 2. Are there reasons why I shouldn't be doing this at all. I
> appreciate that there would be a performance hit , and obviously
> I only want reverse DNS lookups when connections are initiated -
> I don't mind latency at that point, and obviously I should use a
> local caching nameserver. But is it all a real mess and I shouldn't
> go there? Why not?
>
> 3. If there is nothing out there, where should I attack this problem
> if I was going to try and roll my own? A netfilter module, right?

  You might want to take a look at countries.nerd.dk for a resource.
It's normally used for spam-blocking (Nigeria, Korea, China, Taiwan,
etc).  But other uses are possible.  The zone nz.countries.nerd.dk
returns 127.0.0.2 for IP addresses in New Zealand.  This works better
than rDNS, because it doesn't care whether the TLD is .nz, or .net, or
org, etc.; it just cares whether the IP address is in NZ.

> [m1800//home/waltdnes]host 210.55.103.160
> 160.103.55.210.in-addr.arpa domain name pointer pop2-port160.jetstart.maxnet.co.nz.

> [m1800//home/waltdnes]host 160.103.55.210.nz.countries.nerd.dk
> 160.103.55.210.nz.countries.nerd.dk has address 127.0.0.2

  Note the swapped order of the 4 octets.  There is also the
zz.countries.nerd.dk "superzone".  For any IP address, it returns
127.0.X.Y where (256 * X) + Y == the numeric ISO country code.

> [m1800//home/waltdnes]host 160.103.55.210.zz.countries.nerd.dk
> 160.103.55.210.zz.countries.nerd.dk has address 127.0.2.42

  Again, note the byte-swapped order.

  countries.nerd.dk is a free effort, so there's no financial guarantee,
but they're a good start.  If you're going to be hitting it hard, you
might consider asking for occasional zone transfers.

-- 
Walter Dnes <waltdnes@waltdnes.org>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.