On 2011-08-09 20:57, Grant Taylor wrote: > On 08/08/11 17:36, Mark Ruth wrote: >> The problem is that the target webserver (i.e. www.example.com ) is >> loadbalanced between like 10 servers having 10 public IPs (which are >> NOT in series), but since IPtables can not accept domain names >> (correct me if i m wrong) I have to select 1 ip address (i.e. >> 201.23.11.22 ) from the pool of 10 available, for my iptables rule. > > It is my (mis)understanding that the iptables command will accept host > names and resolve them to an IP which is inserted in to the kernel. So, > you are close. Yes, it will. However, this will make loading your firewall rules block on DNS. If you are loading the firewall as the interface comes up, that may be a problem for you. For critical systems, especially routers, I use only IP addresses in the firewall script. Regards, Tyler -- "No one can terrorize a whole nation, unless we are all his accomplices." -- Edward R. Murrow -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
