Can anyone please suggest a way to use a domain name in iptables rules.


If it is all possible please consider setting up a transparent application-level proxy. An application proxy will probably be much easier to do this type of filtering with.

If you must do it with iptables a kludgy option would be to create a chain, create a command line script that periodically updates that particular chain with the results from DNS for the name you need to use.

If someone was going to attempt to create such a thing that truly did packet-filtering based DNS it would almost certainly have to be done via userspace. Specifically you would use something like libnetfilter_queue. I have never used it, but Packetbl may be close to do this, but it doesn't appear to be very well maintained.

Another alternative might be to setup Layer 7 filtering. You might be able to filter a portion of the request if DNS name is being transmuted as part of the payload of the packet.


I needed iptables to allow ssh access based on domain name from my home ip but wanted to keep it closed for all other addresses. Since I have a dynamic ip that changes occasionally, I wrote a script to update the rules based on the ip of my dynamic dns entry. I'm new at this so I'm sure there is a better way. Replace "yourname" with your dynamic dns hostname.


/usr/bin/nslookup yourname.dynalias.org > temp
while read LINE
 if [[ "$LINE" == Address* ]]; then
        let found++
        if [[ $found == 2 ]]; then
                /sbin/iptables-save > /root/rulesdump
                while read LINE2
                        if [[ "$LINE2" == *$address* ]]; then
                done < /root/rulesdump;
                if [[ "$ruleexists" != 1 ]]; then
                        /sbin/iptables -D INPUT -j LOG_DROP
                        /sbin/iptables -A INPUT -s $address -p tcp -m tcp --dport 22 -j LOG_ACCEPT
                        /sbin/iptables -A INPUT -j LOG_DROP
done < /root/temp;

Put the above script in crontab to run every so often.

  • 2
    Its hard for me to decipher whether you do remove old IPs or not. I would also consider using a separate chain so you could make a more straight forward "here's all the new config, just replace the old" approach.
    – Theuni
    Dec 8 '12 at 23:32

Short answer, if you are sure the IP is static forever:

iptables -A INPUT -s `dig host.your-domain-name.com +short`/32 -p tcp -m tcp --dport 22 -j ACCEPT

Same thing in ruby and shorter:

#!/usr/bin/env ruby
require 'resolv'
ip = Resolv.getaddress "mydomain.com"
`iptables -A INPUT -p tcp --dport 22 -s #{ip} -j ACCEPT` if `iptables --list` !~ /#{ip}/
  • 2
    Please note that your script would never remove old IPs AFAICT.
    – Theuni
    Dec 8 '12 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.