Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this:

# Allow traffic to google.com
iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT
iptables -A zone_lan_forward -p tcp -d 11.12.13.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 11.12.13.0/24 -j ACCEPT
iptables -A zone_lan_forward -p tcp -d 101.102.103.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 101.102.103.0/24 -j ACCEPT
...

Obviously those addresses are hypothetical, but you get the idea. My firewall is becoming enormous. It would be much easier to maintain if I could just do this:

# Allow traffic to google.com
iptables -A zone_lan_forward -p tcp -d google.com -j ACCEPT
iptables -A zone_lan_forward -p udp -d google.com -j ACCEPT

I believe this is possible, since man iptables says:

Address can be either a network name, a hostname (please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea), a network IP address (with /mask), or a plain IP address.

But what I'm concerned about is the part that says "specifying any name to be resolved with... DNS is a really bad idea". Why is this a bad idea? Does it just slow everything down?

If I really shouldn't use hostnames in iptables rules, then what should I do to simplify my firewall?

share|improve this question
    
You'll get a better answer on security.stackexchange.com –  Jim B May 17 '13 at 16:16
    
You might be right that this question belongs on that site, but if you have a problem with the accepted answer please explain why. –  Koveras May 17 '13 at 16:20
    
If you want to know about locking down your network and how to do so, ask on security, if you want to use iptables (as opposed to the using IPtables) then this is the place. –  Jim B May 21 '13 at 20:38

4 Answers 4

up vote 10 down vote accepted
  • DNS Names are resolved when the rules are added, not, when packets are checked. This violates the expectations most people have.
    • The rule does not get updated to reflect changed DNS results. It is resolved when added and that is it. You will need to either periodically reload rules, or some sites may break.
  • There is a bit of a security issue in that you are basically delegating control of your firewall rules to an external entity.
    • What if your parent DNS server is compromised and returns false data.

If your purpose is to block HTTP access, then you are usually far better of setting up a piece of software designed to filter at that level (e.g. squid+squidquard).

share|improve this answer
    
1) I see how this could be an issue - google.com could resolve to 1.2.3.4 today but tomorrow that address is invalid. Would simply restarting the firewall take care of this? 2) Is it still a security issue if the DNS server is well known - such as Google's DNS or OpenDNS? –  Koveras May 17 '13 at 15:47
    
I marked this as the answer because it explains why I shouldn't use hostnames in iptables rules and gives me a course of action for simplifying my firewall. –  Koveras May 17 '13 at 16:08
    
I'd like to add my support for Squid. I implemented Squid for my office, and once set up it's very easy to maintain for whitelisting hosts (though I use it to blacklist). It seems like you have a monumental undertaking on your hands; I wouldn't even know where to start whitelisting Google for example. www.google.com resolves to 5 IPs alone, which is to say nothing for ssl.gstatic.com, and all the other hosts involved in authentication, G+, etc which probably resolve to multiple IPs each. –  s.co.tt May 17 '13 at 18:48
    
Monumental is a good way to put it. But I was just using Google as an example. A basic outline of my firwall goes like this: if the packet's destination is whitelisted, accept it. Otherwise send it through a proxy server. –  Koveras May 17 '13 at 22:20

If you use hostnames in your firewall, your firewall is now dependent on DNS. This opens the firewall to a number of issues:

  • DNS lookups under high volumes could cause latency.
  • DNS changes do not propagate instantly. So your firewall could be using cached IPs.
  • DNS can be spoofed, hijacked, hacked.
  • DNS can fail - meaning your firewall fails.
  • Your firewall rules are now controlled by a 3rd party.

If you use hostnames and you do not control the DNS, then someone else effectively controls your IPtables rules. Mistakes, errors or security issues on their end become problems for you.

The only time I've seen hostnames used well is for internal operations. I've worked in an office where IPs and hostnames were assigned via DHCP. The firewalls used hostnames to put barriers between different groups. Since this was all internally controlled it worked well.

share|improve this answer
    
This is a good answer but it's missing the part that would help me simplify the firewall. –  Koveras May 17 '13 at 16:03

You could use a wrapper around iptables like shorewall to make your rules easier to mantain.

share|improve this answer
    
This is a good idea but you didn't tell me why I shouldn't use hostnames in iptables rules. –  Koveras May 17 '13 at 16:07
    
I don't know much about Shorewall, but I'm under the impression that davidkennedy85 would still need to maintain lists of every IP address of a service he'd want to allow within the Shorewall configs. It might make managing netfilter [& etc] a bit easier, but wouldn't solve his core problem, which is a massive list of IPs. –  s.co.tt May 17 '13 at 18:37

As the others have already said you shouln't use DNS resolvable names in iptables rules. They are inaccurate, controlled by third party and are generally a Bad Thing (tm). I'd also add that your DNS may fail or may be unreachable at the time the iptables service is starting. In which case the rule won't be added at all and a whole new type of problems may happen (like loosing ssh access after restart).

What you can do is:

  1. Use custom chains to logically seperate the rules
  2. Use ipsets to have addresses grouped and seperated from the rules
  3. Add comments to the rules

Also noone said anything bad about hostnames which are not resolved by DNS (i.e. are specified in hosts. You can use them if you really need to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.