В Пнд, 27/04/2009 в 10:08 +0300, Ivan Petrushev пишет: > Yes, ofcourse it won't work in that way :) > I can't think of a solution that does not include ruleset reloading > after X time... The better way is to insert rule when you have got your IP (on connect) and remove it on disconnect. > It would be best if you can bypass the changeable > "address" part of the rules with something else - like in/out > interface. It would work if your station doesn't have aliases and the > rules are not targetting specific host if the machine is a router. > > On Mon, Apr 27, 2009 at 9:56 AM, <lists@xxxxxxxxxxxxxxx> wrote: > >> > If iptables would have to perform a DNS lookup everytime a packet > >> > passes, I think it would be terribly slow and probably not usable > >> > for packetfiltering. > >> > >> Actually the DNS lookup is performed only once - in the time the > >> ruleis inserted/appended. If the DNS returns more than one IP per > >> name, a number of rules is inserted with each IP returned. > > > > Yes, that's more or less what Jorge described. My point was that if the > > Netfilter framework had to perform a DNS lookup for each (new?) packet > > that it has to check, I think it would be quite slow (think about DNS > > query timeouts, etc) and not so usable as it is now. > > > > > > Grts, > > Rob > > > > > > -- > > To unsubscribe from this list: send the line "unsubscribe netfilter" in > > the body of a message to majordomo@xxxxxxxxxxxxxxx > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Покотиленко Костик <casper@xxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
