Hello,
Jorge Bastos a écrit :
That is no solution. it may be for your cenario but not for the most of
people. Just think, if who makes the connection is a modem, and you have
your *unix machine on nat, that won't work.
Whether the host is behind a NAT device or not is irrelevant. If there
is a NAT device, its address is irrelevant to the iptables running on
the host behind it.
For iptables to do a DNS query every time a packet comes, that's a disaster.
But other thing cames in mind, when doing: "iptables -L" it does a reverse
lookup on the IP's, is iptables doing a reverse lookup on every packet? or
only when listing the rules?
Only when adding/removing/listing rules.
iptables comes in two parts :
1) A userland part, usually the iptables command, adds/removes/lists
rules into the kernel. Before doing so it may do DNS lookups to resolve
names into addresses.
2) A kernel part which enforces the ruleset for every packet. It does
not do DNS lookups, as the kernel itself does not even know about DNS
(/etc/resolv.conf et al. are userland stuff).
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
