So I'm trying to accept connections on port 80 only from those IPs whose reverse DNS has a CNAME alias like, for example, *.test.mydomain.com: resolves to boo.foo.com


*.test.mydomain.com CNAME boo.foo.com

then accept the connection.

Any tips?

  • 2
    This is both complicated, unreliable - and at worst case: Insecure. Have you considered just allowing access to a known set of networks instead? – Kvisle Oct 21 '11 at 23:50
  • any tips? Yes - don't do it! – Alnitak Oct 22 '11 at 8:39
  • @Mark: use IP addresses or IP ranges, or better yet, use a form of authentication that can give a reasonable assurance that your visitors are who they say they are. DNS as a method of authentication is not reliable and most firewalls don't filter above layer 3 anyways. – gravyface Oct 22 '11 at 13:20

iptables has deal with IP addresses and subnets, not with DNS records.

You have to write script, which will perform full zone transfer (something like dig -t AXFR test.mydomain.com), parse obtained zone file to get all CNAMEs from it, resolve them to IP addresses and add rules to iptables. Then you should place this script in cron.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.