Adding a rule in iptables with destination ip that won't resolved to it domain

Question

I'm adding this rule in iptables with the following IP address as destination:

iptables -A FOR_FILTER -d 66.235.138.59 -j ACCEPT

it added it successfully with the following result:

ACCEPT     all  --  anywhere             *.d1.sc.omtrdc.net

The rule I wanted to apply to 66.235.138.59 won't work because of this DNS resolve. I would like to add the IP address as is, so iptables won't add the resolved domain.

something like this(but it doesn't work):

iptables -A FOR_FILTER -d "66.235.138.59" -j ACCEPT
iptables -A FOR_FILTER -d '66.235.138.59' -j ACCEPT

Answer 1

Iptables use IP addresses internally, if you don't want to see any DNS names when listing the rules, use iptables -L -n - it disables reverse DNS lookup.

Answer 2

Two things to your question. One, as CodePainters noted, you need to use -n switch to see IP address in the listing of iptable rules.

Second thing is, iptables process rules in an order. If some previous rule forbade the connection, then adding another rule (-A adds at the end of the chain) will not help. You need to analyse the whole configuration, not just a single rule.

Answer 3

from the manpage:

   -s, --source [!] address[/mask]
          Source specification.  Address can be either a network  name,  a
          hostname  **(please  note  that specifying any name to be resolved
          with a remote query such as DNS is a really bad idea)**,  network
          IP address (with /mask), or a plain IP address.



   -d, --destination [!] address[/mask]
          Destination  specification.   See  the  description  of  the  -s
          (source)  flag  for  a  detailed description of the syntax.



   -n, --numeric
          Numeric  output.   IP addresses and port numbers will be printed
          in numeric format.  By default, the program will try to  display
          them  as host names, network names, or services (whenever appli-
          cable).

When you are adding rules, use IP numbers and not names. When you are listing rules, if you want the name, omit the -n option. To speed things up and remove the ns lookup step, add the -n to your -L.

You say: "The rule I wanted to apply to 66.235.138.59 won't work because of this DNS resolve."

I say, DNS has got nothing to do with it.