Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm on a simple linux proxy. I'd like to add iptable rules to drop all requests for a specific domain. I figured I run a dig command to get the ip addresses for the domain and then add an iptable rule for each one. It seems, however, that it doesn't work to bind to more than one ip address. So, it seems I need to add ip ranges like this...

iptables -I FORWARD -p tcp -m iprange --dst-range --dport 443 -j DROP

That seems to work. However, it has proven pretty problematic to parse the output of dig and correctly create the appropriate iptable rules. Is there a better way?

share|improve this question
A better solution would be to work with the DNS requests. Either run a DNS proxy and filter the domain out, or do an iptables text match on the DNS queries and reject those packets. – Patrick Jun 9 '12 at 7:33
Thanks for your comment! In this instance I don't think DNS will work because we only want it to apply to port 443 traffic not port 80 traffic. As I understand it there is no way in a DNS request to distinguish between the two. – user548971 Jun 9 '12 at 17:07

You can specify hostnames in iptables commands which will get resolved at rule-add time. Hostnames which resolve to multiple IPs are also supported, although they generate multiple rules.

% sudo iptables --append FORWARD --protocol tcp --destination --dport 443 --jump DROP
% sudo iptables -nL FORWARD
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --         tcp dpt:443
DROP       tcp  --         tcp dpt:443
DROP       tcp  --         tcp dpt:443
DROP       tcp  --         tcp dpt:443
DROP       tcp  --         tcp dpt:443
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.