Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a rented dedicated server that I host certain services on.

For security reasons I made a rule chain that will check against listed DDNS addresses and only connect to the connections that match. It seemed to be better than block or accept by country.

Ex.

-A ACCEPT_PERSONAL -s xxx.dns.com -j ACCEPT
-A ACCEPT_PERSONAL -s yyy.dns.com -j ACCEPT

It worked well for a while, but after a few days all the sudden I couldn't access my server. After some support from the hosting I was able to access via webmin, and found that my DDNS addresses in the iptable have been replaced to actual IPs, and since they have changed for whatever reason.

Any ideas on to what has happened? I have checked the cron jobs, especially weekly but cannot find anything suspicious.

Also I am using Webmin to set the values

share|improve this question

4 Answers 4

up vote 2 down vote accepted

DNS resolution happens before the firewall rule is loaded into the kernel, so you can't do what you want to do using iptables.

share|improve this answer
    
it seems to be working while the IP is correct(before another IP is assinged for the DDNS). I have added an example and more description –  Saifis Jan 19 '10 at 7:50
    
Yes, that's exactly the symptoms you'll see. –  womble Jan 19 '10 at 8:11
1  
womble is correct. if you view the chain using iptables -Lnv ACCEPT_PERSONAL you will see that the rules reference the IP, not the hostname. You can schedule a cronjob to replace the rules on a semi-regular basis, which would "freshen" the IP fairly well. –  jeff Jan 21 '10 at 20:17
    
If you still need to do this, you could write yourself a script called by cron that periodically deletes the old rule(s) and adds a new one based on the DDNS name. –  Zoredache Jan 23 '10 at 20:30

You have mentioned that you are checking against listed DDNS addresses. Many a times I have seen that these lists are not reliable 100%. My own static IP in some lists is categorised as Dynamic. So may the public IP from where you tried to access your machine also got into the DDNS list. If you are trying to protect your system from SSH attacks I would suggest some think like DenyHosts

share|improve this answer
    
thanks, will try –  Saifis Jan 20 '10 at 1:33

As womble said, iptables does its name resolution when rules are loaded. You might want to manage access using hosts.allow, e.g.

sshd: xxx.dns.com
sshd: yyy.dns.com

You could also manage access using "AllowUsers" in sshd_config. Either method would look up your address at connection time.

share|improve this answer
    
thanks I will try that –  Saifis Jan 22 '10 at 7:27
    
tried, but this does not work if the DDNS service does not support reverse lookup –  Saifis Jan 22 '10 at 8:46

fail2ban has worked great for me on my virtual server. It can be configured to work with multiple services, ssh, ftp, etc. I currently use it to block brute force attempts on SSH and FTPS. It will auto ban the IP for a time period using iptables after X failed attempts to log into your server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.