I'm adding this rule in iptables with the following IP address as destination:

iptables -A FOR_FILTER -d -j ACCEPT

it added it successfully with the following result:

ACCEPT     all  --  anywhere             *.d1.sc.omtrdc.net

The rule I wanted to apply to won't work because of this DNS resolve. I would like to add the IP address as is, so iptables won't add the resolved domain.

something like this(but it doesn't work):

iptables -A FOR_FILTER -d "" -j ACCEPT
iptables -A FOR_FILTER -d '' -j ACCEPT

Iptables use IP addresses internally, if you don't want to see any DNS names when listing the rules, use iptables -L -n - it disables reverse DNS lookup.

|improve this answer|||||
  • i understand, but if it only problem of listing then why this rule wont apply in attempt to connect to – python May 10 '11 at 13:30
  • As Pawel says, we'll need to see all your rules to help with that. CodeP is right about the lookup issue affecting iptables -L, not the internal state of netfilter. – MadHatter May 10 '11 at 14:02
  • thanks for the reply,please.. im not that a beginner hehe i do know how iptable works and tables order, so i would please like to understand, every rule added to a chain is always an ip address and -L resolve to the domain just for display? – PyThoN May 10 '11 at 14:45
  • You ask "every rule added to a chain is always an ip address and -L resolve to the domain just for display?" Yes, that is correct; internally, netfilter deals only in ip addresses. – MadHatter May 11 '11 at 11:27
  • I always use "iptables -nvL" to list the tables, reverse DNS in this case is pretty much pointless. – Paul M Apr 14 '16 at 21:02

Two things to your question. One, as CodePainters noted, you need to use -n switch to see IP address in the listing of iptable rules.

Second thing is, iptables process rules in an order. If some previous rule forbade the connection, then adding another rule (-A adds at the end of the chain) will not help. You need to analyse the whole configuration, not just a single rule.

|improve this answer|||||

from the manpage:

   -s, --source [!] address[/mask]
          Source specification.  Address can be either a network  name,  a
          hostname  **(please  note  that specifying any name to be resolved
          with a remote query such as DNS is a really bad idea)**,  network
          IP address (with /mask), or a plain IP address.

   -d, --destination [!] address[/mask]
          Destination  specification.   See  the  description  of  the  -s
          (source)  flag  for  a  detailed description of the syntax.

   -n, --numeric
          Numeric  output.   IP addresses and port numbers will be printed
          in numeric format.  By default, the program will try to  display
          them  as host names, network names, or services (whenever appli-

When you are adding rules, use IP numbers and not names. When you are listing rules, if you want the name, omit the -n option. To speed things up and remove the ns lookup step, add the -n to your -L.

You say: "The rule I wanted to apply to won't work because of this DNS resolve."

I say, DNS has got nothing to do with it.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.