Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone please suggest a way to use a domain name in iptables rules.

share|improve this question

If it is all possible please consider setting up a transparent application-level proxy. An application proxy will probably be much easier to do this type of filtering with.

If you must do it with iptables a kludgy option would be to create a chain, create a command line script that periodically updates that particular chain with the results from DNS for the name you need to use.

If someone was going to attempt to create such a thing that truly did packet-filtering based DNS it would almost certainly have to be done via userspace. Specifically you would use something like libnetfilter_queue. I have never used it, but Packetbl may be close to do this, but it doesn't appear to be very well maintained.

Another alternative might be to setup Layer 7 filtering. You might be able to filter a portion of the request if DNS name is being transmuted as part of the payload of the packet.

share|improve this answer

I needed iptables to allow ssh access based on domain name from my home ip but wanted to keep it closed for all other addresses. Since I have a dynamic ip that changes occasionally, I wrote a script to update the rules based on the ip of my dynamic dns entry. I'm new at this so I'm sure there is a better way. Replace "yourname" with your dynamic dns hostname.


/usr/bin/nslookup > temp
while read LINE
 if [[ "$LINE" == Address* ]]; then
        let found++
        if [[ $found == 2 ]]; then
                /sbin/iptables-save > /root/rulesdump
                while read LINE2
                        if [[ "$LINE2" == *$address* ]]; then
                done < /root/rulesdump;
                if [[ "$ruleexists" != 1 ]]; then
                        /sbin/iptables -D INPUT -j LOG_DROP
                        /sbin/iptables -A INPUT -s $address -p tcp -m tcp --dport 22 -j LOG_ACCEPT
                        /sbin/iptables -A INPUT -j LOG_DROP
done < /root/temp;

Put the above script in crontab to run every so often.

share|improve this answer
Its hard for me to decipher whether you do remove old IPs or not. I would also consider using a separate chain so you could make a more straight forward "here's all the new config, just replace the old" approach. – Theuni Dec 8 '12 at 23:32

Same thing in ruby and shorter:

#!/usr/bin/env ruby
require 'resolv'
ip = Resolv.getaddress ""
`iptables -A INPUT -p tcp --dport 22 -s #{ip} -j ACCEPT` if `iptables --list` !~ /#{ip}/
share|improve this answer
Please note that your script would never remove old IPs AFAICT. – Theuni Dec 8 '12 at 23:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.