Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I'm trying to accept connections on port 80 only from those IPs whose reverse DNS has a CNAME alias like, for example, *.test.mydomain.com:

1.1.1.1 resolves to boo.foo.com

and

*.test.mydomain.com CNAME boo.foo.com

then accept the connection.

Any tips?

share|improve this question
2  
This is both complicated, unreliable - and at worst case: Insecure. Have you considered just allowing access to a known set of networks instead? –  Kvisle Oct 21 '11 at 23:50
    
any tips? Yes - don't do it! –  Alnitak Oct 22 '11 at 8:39
    
@Mark: use IP addresses or IP ranges, or better yet, use a form of authentication that can give a reasonable assurance that your visitors are who they say they are. DNS as a method of authentication is not reliable and most firewalls don't filter above layer 3 anyways. –  gravyface Oct 22 '11 at 13:20

1 Answer 1

iptables has deal with IP addresses and subnets, not with DNS records.

You have to write script, which will perform full zone transfer (something like dig -t AXFR test.mydomain.com), parse obtained zone file to get all CNAMEs from it, resolve them to IP addresses and add rules to iptables. Then you should place this script in cron.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.