up vote 0 down vote favorite
share [g+] share [fb]

So I'm trying to accept connections on port 80 only from those IPs whose reverse DNS has a CNAME alias like, for example, *.test.mydomain.com:

1.1.1.1 resolves to boo.foo.com

and

*.test.mydomain.com CNAME boo.foo.com

then accept the connection.

Any tips?

link|improve this question
2  
This is both complicated, unreliable - and at worst case: Insecure. Have you considered just allowing access to a known set of networks instead? – Kvisle Oct 21 '11 at 23:50
any tips? Yes - don't do it! – Alnitak Oct 22 '11 at 8:39
@Mark: use IP addresses or IP ranges, or better yet, use a form of authentication that can give a reasonable assurance that your visitors are who they say they are. DNS as a method of authentication is not reliable and most firewalls don't filter above layer 3 anyways. – gravyface Oct 22 '11 at 13:20
feedback

1 Answer

up vote 1 down vote

iptables has deal with IP addresses and subnets, not with DNS records.

You have to write script, which will perform full zone transfer (something like dig -t AXFR test.mydomain.com), parse obtained zone file to get all CNAMEs from it, resolve them to IP addresses and add rules to iptables. Then you should place this script in cron.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.