Yes, ofcourse it won't work in that way :) I can't think of a solution that does not include ruleset reloading after X time... It would be best if you can bypass the changeable "address" part of the rules with something else - like in/out interface. It would work if your station doesn't have aliases and the rules are not targetting specific host if the machine is a router. On Mon, Apr 27, 2009 at 9:56 AM, <lists@xxxxxxxxxxxxxxx> wrote: >> > If iptables would have to perform a DNS lookup everytime a packet >> > passes, I think it would be terribly slow and probably not usable >> > for packetfiltering. >> >> Actually the DNS lookup is performed only once - in the time the >> ruleis inserted/appended. If the DNS returns more than one IP per >> name, a number of rules is inserted with each IP returned. > > Yes, that's more or less what Jorge described. My point was that if the > Netfilter framework had to perform a DNS lookup for each (new?) packet > that it has to check, I think it would be quite slow (think about DNS > query timeouts, etc) and not so usable as it is now. > > > Grts, > Rob > > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
