Re: randomly changing IPs from different subnets (Google Mail)

[Lars Nooden <lars.curator@gmail.com>]

On 22.06.2010 um 11:53 schreib Florian Effenberger:
> Hi Lars,
>
> Am 22.06.2010 um 21:16 schrieb Lars Nooden:
>
> the same Lars Nooden as from the OOo mailing lists? If so: It's a
> small world. ;-)

Yes.  Hello again.

>> The chain is a drop-through list of ip addresses that you have
>> decided are good.  Then make a rule or pair of rules to send tcp
>> traffic for port 993 and port 537 to that user-defined chain.
>
> If I run a script every 60 seconds per cron and add the hostname, it
> will automatically add all IPs returned by the DNS at that time.
> However, this changes randomly, and change time is not predictable.

As others mentioned, it is probably a round-robin algorithm for a small 
pool of ip addresses.  Google might even tell you which ones or you can 
keep polling.

Once you acquire a list of the allowed destination ip numbers, the 
hostnames probably don't need to get polled more frequently than the ttl 
for the main dns record.  If you work with the ip addresses, rather than 
the hostnames that need for look-up is minimized.

> If I add ten times the host and it resolves to the same IP, iptables
> doesn't recognize that, and I have 10 similar rules. Is there any
> check for duplicates possible?

AFAIK, not inherently in iptables itself, but if you make a separate 
chain, it is easier to work on it via grep and sort.   Use 'iptables 
-nL' or 'iptables-save' and send the output to grep, looking for the ip 
number in question, if it is not present, add it.   That's simple shell 
scripting.

/Lars