16

My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this:

# Allow traffic to google.com
iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT
iptables -A zone_lan_forward -p tcp -d 11.12.13.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 11.12.13.0/24 -j ACCEPT
iptables -A zone_lan_forward -p tcp -d 101.102.103.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 101.102.103.0/24 -j ACCEPT
...

Obviously those addresses are hypothetical, but you get the idea. My firewall is becoming enormous. It would be much easier to maintain if I could just do this:

# Allow traffic to google.com
iptables -A zone_lan_forward -p tcp -d google.com -j ACCEPT
iptables -A zone_lan_forward -p udp -d google.com -j ACCEPT

I believe this is possible, since man iptables says:

Address can be either a network name, a hostname (please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea), a network IP address (with /mask), or a plain IP address.

But what I'm concerned about is the part that says "specifying any name to be resolved with... DNS is a really bad idea". Why is this a bad idea? Does it just slow everything down?

If I really shouldn't use hostnames in iptables rules, then what should I do to simplify my firewall?

Improve this question
3
  • You'll get a better answer on security.stackexchange.com
    – Jim B
    May 17, 2013 at 16:16
  • You might be right that this question belongs on that site, but if you have a problem with the accepted answer please explain why.
    – Big McLargeHuge
    May 17, 2013 at 16:20
  • If you want to know about locking down your network and how to do so, ask on security, if you want to use iptables (as opposed to the using IPtables) then this is the place.
    – Jim B
    May 21, 2013 at 20:38

5 Answers 5

Reset to default
30
  • DNS Names are resolved when the rules are added, not, when packets are checked. This violates the expectations most people have.
    • The rule does not get updated to reflect changed DNS results. It is resolved when added and that is it. You will need to either periodically reload rules, or some sites may break.
  • There is a bit of a security issue in that you are basically delegating control of your firewall rules to an external entity.
    • What if your parent DNS server is compromised and returns false data.

If your purpose is to block HTTP access, then you are usually far better of setting up a piece of software designed to filter at that level (e.g. squid+squidquard).

Improve this answer
5
  • 1) I see how this could be an issue - google.com could resolve to 1.2.3.4 today but tomorrow that address is invalid. Would simply restarting the firewall take care of this? 2) Is it still a security issue if the DNS server is well known - such as Google's DNS or OpenDNS?
    – Big McLargeHuge
    May 17, 2013 at 15:47
  • 1
    I marked this as the answer because it explains why I shouldn't use hostnames in iptables rules and gives me a course of action for simplifying my firewall.
    – Big McLargeHuge
    May 17, 2013 at 16:08
  • I'd like to add my support for Squid. I implemented Squid for my office, and once set up it's very easy to maintain for whitelisting hosts (though I use it to blacklist). It seems like you have a monumental undertaking on your hands; I wouldn't even know where to start whitelisting Google for example. www.google.com resolves to 5 IPs alone, which is to say nothing for ssl.gstatic.com, and all the other hosts involved in authentication, G+, etc which probably resolve to multiple IPs each.
    – s.co.tt
    May 17, 2013 at 18:48
  • Monumental is a good way to put it. But I was just using Google as an example. A basic outline of my firwall goes like this: if the packet's destination is whitelisted, accept it. Otherwise send it through a proxy server.
    – Big McLargeHuge
    May 17, 2013 at 22:20
  • There's also the problem of systems that use DNS for load balancing. You may not get the same results if you look up such a domain twice in a row, so a single lookup isn't even going to give you an exhaustive list of IP addresses that the domain could possibly resolve to.
    – cdhowie
    May 29, 2018 at 21:40
10

If you use hostnames in your firewall, your firewall is now dependent on DNS. This opens the firewall to a number of issues:

  • DNS lookups under high volumes could cause latency.
  • DNS changes do not propagate instantly. So your firewall could be using cached IPs.
  • DNS can be spoofed, hijacked, hacked.
  • DNS can fail - meaning your firewall fails.
  • Your firewall rules are now controlled by a 3rd party.

If you use hostnames and you do not control the DNS, then someone else effectively controls your IPtables rules. Mistakes, errors or security issues on their end become problems for you.

The only time I've seen hostnames used well is for internal operations. I've worked in an office where IPs and hostnames were assigned via DHCP. The firewalls used hostnames to put barriers between different groups. Since this was all internally controlled it worked well.

Improve this answer
1
  • 2
    This is a good answer but it's missing the part that would help me simplify the firewall.
    – Big McLargeHuge
    May 17, 2013 at 16:03
3

You could use a wrapper around iptables like shorewall to make your rules easier to mantain.

Improve this answer
2
  • This is a good idea but you didn't tell me why I shouldn't use hostnames in iptables rules.
    – Big McLargeHuge
    May 17, 2013 at 16:07
  • I don't know much about Shorewall, but I'm under the impression that davidkennedy85 would still need to maintain lists of every IP address of a service he'd want to allow within the Shorewall configs. It might make managing netfilter [& etc] a bit easier, but wouldn't solve his core problem, which is a massive list of IPs.
    – s.co.tt
    May 17, 2013 at 18:37
3

I personally assign a hostname to a ip manually in /etc/hosts and then use it in iptables.

This way you

  1. Do not offload your Firewall rules to an external entity
  2. Have easily maintainable iptables
Improve this answer
2

As the others have already said you shouln't use DNS resolvable names in iptables rules. They are inaccurate, controlled by third party and are generally a Bad Thing (tm). I'd also add that your DNS may fail or may be unreachable at the time the iptables service is starting. In which case the rule won't be added at all and a whole new type of problems may happen (like loosing ssh access after restart).

What you can do is:

  1. Use custom chains to logically seperate the rules
  2. Use ipsets to have addresses grouped and seperated from the rules
  3. Add comments to the rules

Also noone said anything bad about hostnames which are not resolved by DNS (i.e. are specified in hosts. You can use them if you really need to.

Improve this answer
1
  • Yes, ipsets are the answer. With a script run from crontab to update the ipset.
    – mivk
    Feb 12, 2020 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .