Re: Dynamic IP address in a rule?

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Jorge Bastos a écrit :
> 
> That is no solution. it may be for your cenario but not for the most of
> people. Just think, if who makes the connection is a modem, and you have
> your *unix machine on nat, that won't work.

Whether the host is behind a NAT device or not is irrelevant. If there 
is a NAT device, its address is irrelevant to the iptables running on 
the host behind it.

> For iptables to do a DNS query every time a packet comes, that's a disaster.
> But other thing cames in mind, when doing: "iptables -L" it does a reverse
> lookup on the IP's, is iptables doing a reverse lookup on every packet? or
> only when listing the rules?

Only when adding/removing/listing rules.
iptables comes in two parts :
1) A userland part, usually the iptables command, adds/removes/lists 
rules into the kernel. Before doing so it may do DNS lookups to resolve 
names into addresses.
2) A kernel part which enforces the ruleset for every packet. It does 
not do DNS lookups, as the kernel itself does not even know about DNS 
(/etc/resolv.conf et al. are userland stuff).