On 22.06.2010 um 11:53 schreib Florian Effenberger:
Hi Lars,
Am 22.06.2010 um 21:16 schrieb Lars Nooden:
the same Lars Nooden as from the OOo mailing lists? If so: It's a
small world. ;-)
Yes. Hello again.
The chain is a drop-through list of ip addresses that you have
decided are good. Then make a rule or pair of rules to send tcp
traffic for port 993 and port 537 to that user-defined chain.
If I run a script every 60 seconds per cron and add the hostname, it
will automatically add all IPs returned by the DNS at that time.
However, this changes randomly, and change time is not predictable.
As others mentioned, it is probably a round-robin algorithm for a small
pool of ip addresses. Google might even tell you which ones or you can
keep polling.
Once you acquire a list of the allowed destination ip numbers, the
hostnames probably don't need to get polled more frequently than the ttl
for the main dns record. If you work with the ip addresses, rather than
the hostnames that need for look-up is minimized.
If I add ten times the host and it resolves to the same IP, iptables
doesn't recognize that, and I have 10 similar rules. Is there any
check for duplicates possible?
AFAIK, not inherently in iptables itself, but if you make a separate
chain, it is easier to work on it via grep and sort. Use 'iptables
-nL' or 'iptables-save' and send the output to grep, looking for the ip
number in question, if it is not present, add it. That's simple shell
scripting.
/Lars
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
