Re: FQDN filtering

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




this is the rule and below is the error .. is this ment to work

$IPTAB -A OUTPUT -p tcp -o eth0 -s 0/0 -d www.microsoft.com -j DROP
##$IPTAB -A FORWARD -s 0/0 -d www.microsoft.com -m state --state NEW -j DROP


starting rules for NATing
iptables v1.2.11: host/network `www.microsoft.com' not found
Try `iptables -h' or 'iptables --help' for more information.


Leonardo Rodrigues Magalhães wrote:


   Well .... yes it can and no it cannot.

All rules can have FQDN instead of IPs. But FQDNs will be solved to IPs and rules will be created using IPs.

Rule:
iptables -A INPUT -s www.microsoft.com -j DROP

is completly valid, but will be translated to:

iptables -A INPUT -s 207.46.198.30 -j DROP
iptables -A INPUT -s 207.46.198.60 -j DROP
iptables -A INPUT -s 207.46.199.30 -j DROP
iptables -A INPUT -s 207.46.225.60 -j DROP
iptables -A INPUT -s 207.46.18.30 -j DROP
iptables -A INPUT -s 207.46.19.30 -j DROP
iptables -A INPUT -s 207.46.19.60 -j DROP
iptables -A INPUT -s 207.46.20.60 -j DROP

when you hit the ENTER key or execute your firewall script. You will not see 'www.microsoft.com' if you do 'iptables -nL -v', you will only see the translated IP addresses. If FQDN changes IP addresses, iptables will not see that change because DNS query for searching IPs is done only when the rule is created.

I think there's a limit on how many IPs iptables can handle for a single FQDN, but I dont know what this limit is.

iptables seems to CANNOT have rules with FQDN and keep the FQDN instead of IPs.

Anyway, filtering FQDNs seems to be nice on application level and not always on IP level. Are you thinking on web filtering ??? Why not using a http proxy (squid) for doing that ?? Are you thinking on SPAM fighting ?? Why not using your MTA capabilities for that ??

   Sincerily,
   Leonardo Rodrigues


rockey dada escreveu:

Is there any way one can use IPTABLES to filter traffic based on "Fully
Qualified Domain Names".

Rgds



______________________________________
XamimeLT - installed on mailserver for domain @nobarrier.co.za
Queries to: postmaster@xxxxxxxxxxxxxxx



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux