Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Would it generally impact the performance of a firewall if it has to enable a site by domain rather than IP? The context is we have an application that runs on Google Appengine (no fixed IP's) and a question was raised by the IT function of a potential customer that opening their firewall for our application will mean they have to do a reverse DNS lookup on every packet if they enable traffic to our domain. I can't imagine this is a unique situation and I'm wandering if this is a general problem with enabling per domain or specific to a technology choice they have made.

Thanks

share|improve this question

2 Answers 2

up vote 3 down vote accepted

There are two choices here:

  1. The firewall does reverse DNS on every new flow. Yes, performance here will be bad, probably real bad.
  2. The firewall will do reverse DNS on startup, or on some schedule. Performance should be fine, though you'll have the same problem if that schedule doesn't line up with AppEngine moves.

My experience is entirely in the latter type, but I'll believe that the former exists. Remember that incoming packets don't have domain names on them, just IPs. That means that every packet or flow needs to be looked up to see if it matches a rule. Not a great recipe for performance.

share|improve this answer

Don't do this. Firewalling by domain is inherently broken and will add complexity with little or no security.

You will be much better off without the firewall rules if you instead rely on Google auth:

https://developers.google.com/appengine/articles/auth

share|improve this answer
    
thanks but as we're reliant upon a third party it may not be an option. –  Richard Jun 11 '13 at 5:38
    
You'll also be beholden to DNS servers. Which can suck. You may end up in a scenario, where the firewall breaks because it cant get to the relevant DNS server. Which depending on your set up, you may not control. Have fun. –  Jason Tan Jun 11 '13 at 18:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.