Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With Apache2, or iptables, is there a way to refuse visitors if their IP has no reverse DNS, or does not resolve at all?

I have a website targeted to a specific population who has valid reverse DNS. Some spammers and hackers that do not have a reverse DNS come and try to spam/hack my site.

They get refused/denied by my spam blocker but I still want to prevent them to access my website.

share|improve this question
2  
Why would you want to do that? –  joeqwerty Jul 31 '10 at 11:27
3  
Just be careful: You're making connection acceptance dependent on DNS - not only are you going to have false failures due to slow DNS servers, EVERYONE is going to get slow service because you have to do a DNS lookup on them. –  Michael Kohne Jul 31 '10 at 12:13
    
I added more info to my question. –  Weboide Jul 31 '10 at 12:53

4 Answers 4

up vote 0 down vote accepted

You could easily do it in php or you favorite language (for php http://php.net/manual/en/function.gethostbyaddr.php). Perhaps if you approve of the visiting client by checking their reverse DNS status you then "log them in" in a similar fashion to a normal username/password login.

Normally .htaccess files or iptables may be a better solution, but since you have a very peculiar request, you may need the flexibility of a scripting language.

share|improve this answer

I wouldn't do this on Apache level due the slowness of the DNS queries.

Instead I would do this behind the curtains. For example, put some self-written shell/perl script to tail the Apache access log, do the dns queries and if they fail, then just add the ip address to (temporary) ban list. You could probably do this with fail2ban if you're not willing to write some Perl for yourself.

Anyway, be careful! Even some legit visitors might not have a resolvable dns name.

share|improve this answer

Several people have pointed out that this is typically a bad idea due to slow DNS resolution. But if you want to do it you can do it with mod_access:

http://httpd.apache.org/docs/2.0/mod/mod_access.html

share|improve this answer
    
Thanks for the link, but you didn't say how. :( –  Weboide Jul 31 '10 at 15:01
    
Click the link? You add an allow with the top-domains you want to allow and a deny all. Then all reverse lookups the fails will block access. –  pehrs Aug 5 '10 at 9:03

In your statement(s) just add something like:

Order Deny,Allow
Deny from all
Allow from .com .gov .org .edu

You'll want to add your local private lan, 127.0.0.1, etc...

share|improve this answer
    
This works, but could get messy fast (especially with the ability to purchase anything you want as a TLD these days). mod_access (or doing the lookup in your software rather than Apache) is probably a better choice. –  voretaq7 Dec 4 '12 at 17:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.