* Can IPTables check for a valid IP address @ 2014-09-18 13:50 Lars Dam 2014-09-18 15:11 ` R. Sterenborg (lists) 0 siblings, 1 reply; 7+ messages in thread From: Lars Dam @ 2014-09-18 13:50 UTC (permalink / raw) To: 'netfilter@vger.kernel.org' We suffer from DNS lookups with a response IP address which is not existing. Can Iptables check on this? Regards, Lars Dam Manager ICT services ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Can IPTables check for a valid IP address 2014-09-18 13:50 Can IPTables check for a valid IP address Lars Dam @ 2014-09-18 15:11 ` R. Sterenborg (lists) 2014-09-18 15:19 ` Lars Dam 2014-09-18 15:31 ` Michael Schwartzkopff 0 siblings, 2 replies; 7+ messages in thread From: R. Sterenborg (lists) @ 2014-09-18 15:11 UTC (permalink / raw) To: Lars Dam, 'netfilter@vger.kernel.org' On 09/18/2014 03:50 PM, Lars Dam wrote: > We suffer from DNS lookups with a response IP address which is not existing. > > Can Iptables check on this? What is it you actually want iptables to do? Do you want it to check if the IP address that the DNS server responds with exists and is in use? Or..? Maybe the DNS server should be fixed instead of trying to go this way. Iptables (well, Netfilter) is a packet filter. You can filter packets that match a rule that you define. It can't validate your DNS server's output. -- Rob > Regards, > > Lars Dam > Manager ICT services > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Can IPTables check for a valid IP address 2014-09-18 15:11 ` R. Sterenborg (lists) @ 2014-09-18 15:19 ` Lars Dam 2014-09-18 15:31 ` Michael Schwartzkopff 1 sibling, 0 replies; 7+ messages in thread From: Lars Dam @ 2014-09-18 15:19 UTC (permalink / raw) To: R. Sterenborg (lists), 'netfilter@vger.kernel.org' Hi Rob, Sure thing! I was just looking for a workaround. I was looking for a way iptables might check if it's a valid (in function) IP address, before a DNS server is handling the request. Regards -----Oorspronkelijk bericht----- Van: R. Sterenborg (lists) [mailto:lists@sterenborg.org] Verzonden: Thursday, September 18, 2014 5:12 PM Aan: Lars Dam; 'netfilter@vger.kernel.org' Onderwerp: Re: Can IPTables check for a valid IP address On 09/18/2014 03:50 PM, Lars Dam wrote: > We suffer from DNS lookups with a response IP address which is not existing. > > Can Iptables check on this? What is it you actually want iptables to do? Do you want it to check if the IP address that the DNS server responds with exists and is in use? Or..? Maybe the DNS server should be fixed instead of trying to go this way. Iptables (well, Netfilter) is a packet filter. You can filter packets that match a rule that you define. It can't validate your DNS server's output. -- Rob > Regards, > > Lars Dam > Manager ICT services > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" > in the body of a message to majordomo@vger.kernel.org More majordomo > info at http://vger.kernel.org/majordomo-info.html > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Can IPTables check for a valid IP address 2014-09-18 15:11 ` R. Sterenborg (lists) 2014-09-18 15:19 ` Lars Dam @ 2014-09-18 15:31 ` Michael Schwartzkopff 2014-09-18 15:53 ` FW: " Lars Dam 1 sibling, 1 reply; 7+ messages in thread From: Michael Schwartzkopff @ 2014-09-18 15:31 UTC (permalink / raw) To: netfilter [-- Attachment #1: Type: text/plain, Size: 1437 bytes --] Am Donnerstag, 18. September 2014, 17:11:36 schrieb R. Sterenborg: > On 09/18/2014 03:50 PM, Lars Dam wrote: > > We suffer from DNS lookups with a response IP address which is not > > existing. > > > > Can Iptables check on this? > > What is it you actually want iptables to do? Do you want it to check if > the IP address that the DNS server responds with exists and is in use? > Or..? Maybe the DNS server should be fixed instead of trying to go this way. > > Iptables (well, Netfilter) is a packet filter. You can filter packets > that match a rule that you define. It can't validate your DNS server's > output iptables cannot help you since the source IP address presumably varies. If the source address does not vary than iptables can help you. Just google "iptables rate limit" Anyway, it seems that you operate a open resolver on your server. Please google, why this is not a good idea. But if you really want to run a open resolver, than read the docs of your DNS server how to limit the request rates. For bind, see: http://ss.vix.su/~vjs/rl-arm.html . Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein [-- Attachment #2: This is a digitally signed message part. --] [-- Type: application/pgp-signature, Size: 230 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* FW: Can IPTables check for a valid IP address 2014-09-18 15:31 ` Michael Schwartzkopff @ 2014-09-18 15:53 ` Lars Dam 2014-09-18 16:29 ` Noel Kuntze 0 siblings, 1 reply; 7+ messages in thread From: Lars Dam @ 2014-09-18 15:53 UTC (permalink / raw) To: 'netfilter@vger.kernel.org' [-- Attachment #1: Type: text/plain, Size: 1770 bytes --] Thanks. I know what to do. Regards, Lars Da, -----Oorspronkelijk bericht----- Van: netfilter-owner@vger.kernel.org [mailto:netfilter-owner@vger.kernel.org] Namens Michael Schwartzkopff Verzonden: Thursday, September 18, 2014 5:31 PM Aan: netfilter@vger.kernel.org Onderwerp: Re: Can IPTables check for a valid IP address Am Donnerstag, 18. September 2014, 17:11:36 schrieb R. Sterenborg: > On 09/18/2014 03:50 PM, Lars Dam wrote: > > We suffer from DNS lookups with a response IP address which is not > > existing. > > > > Can Iptables check on this? > > What is it you actually want iptables to do? Do you want it to check > if the IP address that the DNS server responds with exists and is in use? > Or..? Maybe the DNS server should be fixed instead of trying to go this way. > > Iptables (well, Netfilter) is a packet filter. You can filter packets > that match a rule that you define. It can't validate your DNS server's > output iptables cannot help you since the source IP address presumably varies. If the source address does not vary than iptables can help you. Just google "iptables rate limit" Anyway, it seems that you operate a open resolver on your server. Please google, why this is not a good idea. But if you really want to run a open resolver, than read the docs of your DNS server how to limit the request rates. For bind, see: http://ss.vix.su/~vjs/rl-arm.html . Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 237 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: FW: Can IPTables check for a valid IP address 2014-09-18 15:53 ` FW: " Lars Dam @ 2014-09-18 16:29 ` Noel Kuntze 2014-09-18 17:48 ` Lars Dam 0 siblings, 1 reply; 7+ messages in thread From: Noel Kuntze @ 2014-09-18 16:29 UTC (permalink / raw) To: Lars Dam, netfilter@vger.kernel.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, If with "invalid", you mean addresses of a certain type (multicast, anycast, broadcast, reserved address space, etc), look at the addrtype module. Mit freundlichen Grüßen/Regards, Noel Kuntze GPG Key ID: 0x63EC6658 Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658 Am 18.09.2014 um 17:53 schrieb Lars Dam: > Thanks. I know what to do. > > Regards, > > Lars Da, > > -----Oorspronkelijk bericht----- > Van: netfilter-owner@vger.kernel.org [mailto:netfilter-owner@vger.kernel.org] Namens Michael Schwartzkopff > Verzonden: Thursday, September 18, 2014 5:31 PM > Aan: netfilter@vger.kernel.org > Onderwerp: Re: Can IPTables check for a valid IP address > > Am Donnerstag, 18. September 2014, 17:11:36 schrieb R. Sterenborg: >> On 09/18/2014 03:50 PM, Lars Dam wrote: >>> We suffer from DNS lookups with a response IP address which is not >>> existing. >>> >>> Can Iptables check on this? >> >> What is it you actually want iptables to do? Do you want it to check >> if the IP address that the DNS server responds with exists and is in use? >> Or..? Maybe the DNS server should be fixed instead of trying to go this way. >> >> Iptables (well, Netfilter) is a packet filter. You can filter packets >> that match a rule that you define. It can't validate your DNS server's >> output > > iptables cannot help you since the source IP address presumably varies. If the source address does not vary than iptables can help you. > > Just google "iptables rate limit" > > > Anyway, it seems that you operate a open resolver on your server. Please google, why this is not a good idea. But if you really want to run a open resolver, than read the docs of your DNS server how to limit the request rates. For bind, see: > > http://ss.vix.su/~vjs/rl-arm.html > . > > > > Mit freundlichen Grüßen, > > Michael Schwartzkopff > > -- > [*] sys4 AG > > http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München > > Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 > Vorstand: Patrick Ben Koetter, Marc Schiffbauer > Aufsichtsratsvorsitzender: Florian Kirstein -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJUGwiHAAoJEDg5KY9j7GZYeDYP/2hf9l/2ByZx1IzMHZfnHE/J bmQYnip8bgRQc51Lcl4K3l06AMlBai947dDHvhFWbYRdJaMIPTLJ6v6Hudh/asSt Tfa2Fdu2cIiSAWWBCcyRW0GqsJdXNrffwAWwWz5w0xv9TvX02Frd0FFyB9RJtmXL yPioe+jLQS8677f/bM4Sy+zRDirGbPsCdBOlb0ysqKFOCue+Xipel640oPsp+HIt C0GudjUMFKdQX66Vo/p69fWdpOEJeqnhpQ375fH89Y8dqjCpTRiOSUng3J/NNrCc ylzfBZV6GRoPca535eXm2OhGcXbkdJkNyK6jJMpoQMjZ6pMiWD7rBzPr4ShVcCA7 2fYOTk68PJRwKp3UJFPP+oIdg1mo8ajc/w8idP72kabEG7i+psaVUxyr3Hw5+Lay 2LgFWiODWc9I3KDD6/pqaT7BvbC9Uvk0lLxx2LoWwrwoc+QO+sW39P4NkBvWUtrt jP4aCAKWqcsh/FHhoI22D7GRurRa7cdDJIlZMa+E+5Zg6o2n0FTnQ2/UG8uSk0EA 6cevkcuEZtJ2sjozvYjfpz0jx0bF+jvl0nivDqLc/wUwLf1WKt7msniy8451seeT eqq9cC2Ythsoi5i+gsRxC9S6pzz+s5icdqeP4tmF144TyljMfewNx0TjhDe3Auy0 I/t9vYIlgFlIo08Eapr1 =UFIr -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: FW: Can IPTables check for a valid IP address 2014-09-18 16:29 ` Noel Kuntze @ 2014-09-18 17:48 ` Lars Dam 0 siblings, 0 replies; 7+ messages in thread From: Lars Dam @ 2014-09-18 17:48 UTC (permalink / raw) To: 'netfilter@vger.kernel.org' Thanks! I will certainly investigate this option. Regards! -----Oorspronkelijk bericht----- Van: Noel Kuntze [mailto:noel@familie-kuntze.de] Verzonden: Thursday, September 18, 2014 6:30 PM Aan: Lars Dam; netfilter@vger.kernel.org Onderwerp: Re: FW: Can IPTables check for a valid IP address -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello, If with "invalid", you mean addresses of a certain type (multicast, anycast, broadcast, reserved address space, etc), look at the addrtype module. Mit freundlichen Grüßen/Regards, Noel Kuntze GPG Key ID: 0x63EC6658 Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658 Am 18.09.2014 um 17:53 schrieb Lars Dam: > Thanks. I know what to do. > > Regards, > > Lars Da, > > -----Oorspronkelijk bericht----- > Van: netfilter-owner@vger.kernel.org > [mailto:netfilter-owner@vger.kernel.org] Namens Michael Schwartzkopff > Verzonden: Thursday, September 18, 2014 5:31 PM > Aan: netfilter@vger.kernel.org > Onderwerp: Re: Can IPTables check for a valid IP address > > Am Donnerstag, 18. September 2014, 17:11:36 schrieb R. Sterenborg: >> On 09/18/2014 03:50 PM, Lars Dam wrote: >>> We suffer from DNS lookups with a response IP address which is not >>> existing. >>> >>> Can Iptables check on this? >> >> What is it you actually want iptables to do? Do you want it to check >> if the IP address that the DNS server responds with exists and is in use? >> Or..? Maybe the DNS server should be fixed instead of trying to go this way. >> >> Iptables (well, Netfilter) is a packet filter. You can filter packets >> that match a rule that you define. It can't validate your DNS >> server's output > > iptables cannot help you since the source IP address presumably varies. If the source address does not vary than iptables can help you. > > Just google "iptables rate limit" > > > Anyway, it seems that you operate a open resolver on your server. Please google, why this is not a good idea. But if you really want to run a open resolver, than read the docs of your DNS server how to limit the request rates. For bind, see: > > http://ss.vix.su/~vjs/rl-arm.html > . > > > > Mit freundlichen Grüßen, > > Michael Schwartzkopff > > -- > [*] sys4 AG > > http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 > Franziskanerstraße 15, 81669 München > > Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 > Vorstand: Patrick Ben Koetter, Marc Schiffbauer > Aufsichtsratsvorsitzender: Florian Kirstein -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJUGwiHAAoJEDg5KY9j7GZYeDYP/2hf9l/2ByZx1IzMHZfnHE/J bmQYnip8bgRQc51Lcl4K3l06AMlBai947dDHvhFWbYRdJaMIPTLJ6v6Hudh/asSt Tfa2Fdu2cIiSAWWBCcyRW0GqsJdXNrffwAWwWz5w0xv9TvX02Frd0FFyB9RJtmXL yPioe+jLQS8677f/bM4Sy+zRDirGbPsCdBOlb0ysqKFOCue+Xipel640oPsp+HIt C0GudjUMFKdQX66Vo/p69fWdpOEJeqnhpQ375fH89Y8dqjCpTRiOSUng3J/NNrCc ylzfBZV6GRoPca535eXm2OhGcXbkdJkNyK6jJMpoQMjZ6pMiWD7rBzPr4ShVcCA7 2fYOTk68PJRwKp3UJFPP+oIdg1mo8ajc/w8idP72kabEG7i+psaVUxyr3Hw5+Lay 2LgFWiODWc9I3KDD6/pqaT7BvbC9Uvk0lLxx2LoWwrwoc+QO+sW39P4NkBvWUtrt jP4aCAKWqcsh/FHhoI22D7GRurRa7cdDJIlZMa+E+5Zg6o2n0FTnQ2/UG8uSk0EA 6cevkcuEZtJ2sjozvYjfpz0jx0bF+jvl0nivDqLc/wUwLf1WKt7msniy8451seeT eqq9cC2Ythsoi5i+gsRxC9S6pzz+s5icdqeP4tmF144TyljMfewNx0TjhDe3Auy0 I/t9vYIlgFlIo08Eapr1 =UFIr -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2014-09-18 17:48 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2014-09-18 13:50 Can IPTables check for a valid IP address Lars Dam 2014-09-18 15:11 ` R. Sterenborg (lists) 2014-09-18 15:19 ` Lars Dam 2014-09-18 15:31 ` Michael Schwartzkopff 2014-09-18 15:53 ` FW: " Lars Dam 2014-09-18 16:29 ` Noel Kuntze 2014-09-18 17:48 ` Lars Dam
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox