1

I would like to block all outgoing traffic to any domain or subdomain using IPTables. It would appear that the -d option allows one to reference a domain. I found the following through a Google search that suggests it can be referenced this way: Allow HTTP traffic only to specific domain(s)

Similarly, we can use the above method to filter other ports and protocols as well, such as standard web traffic operating on tcp port 80.

iptables -I FORWARD 1 -p tcp -d dd-wrt.com --dport 80 -j ACCEPT
iptables -I FORWARD 2 -p tcp --dport 80 -j DROP

Which would accept all http traffic to dd-wrt.com, while blocking outgoing http traffic to anywhere else. If you wish to allow multiple sites, insert additional rules before the DROP (making sure to order and number them correctly).

However what I would like to do is reference *.domain.com (e.g. block all outgoing traffic to *.youtube.com or similar).

Does anyone know if this is possible and if so, what is the syntax for the -d option in IPTables to support a wildcard subdomain?

Improve this question
  • Have you looked at OpenDNS? That might fit better for what you appear to be trying to do. – Grant Mar 8 '13 at 21:31
  • What has OpenDNS got to do with this question? I want to block subdomains in IPTables. Please explain your answer? – user1503091 Mar 8 '13 at 22:20
  • It blocks at the dns level. It can be more effective for blocking things like youtube or facebook with have many often changing ip addresses. – Grant Mar 8 '13 at 22:47
  • Dnsmasq with ipset feature can add the resolved ip to an ipset, then filter the ipset in iptables. – wrkwrk Jun 12 '17 at 6:13
4

DNS resolution in IPtables is a little funny. At run time the firewall acts on IP address only, not on domain names. Let's take the process step by step for clarity.

  1. You add a rule with: iptables -I FORWARD 1 -p tcp -d dd-wrt.com --dport 80 -j ACCEPT
  2. IPtables passes dd-wrt.com to the resolver subsystem.
  3. Resolver subsystem returns: 83.141.4.210
  4. IPtables modifies and creates rule as: -p tcp -d 83.141.4.210 --dport 80 -j ACCEPT

If the domain name returned multiple addresses, such as www.google.com, then inserts a copy of that rule for each IP address returned. Unless, of course, you use the --replace option in which case multiple returned addresses will cause it to fail.

This lookup only happens when the rule is added. So if dd-wrt.com is moved to a new host then your rule will no longer work correctly. You will have to delete and re-add or restart the firewall to have the new address take effect.

As a result you can simply the implications to mean that you cannot use it to block based on domain name at all. You are only ever blocking on IP address, you may be simply using a domain name to occasionally retrieve the address. Similarly, wild cards won't work either. The hostname *.dd-wrt.com does not have an A record, therefore it cannot be converted into an IP address.

It is generally in your best interest to block or deny based solely on IP address. That way there is no confusion for you, or your staff, on what is supposed to be blocked (or allowed) versus what actually is.

Improve this answer
  • Thanks Scott. That makes perfect sense. I'm wondering if the answer here might be that I write a script to look for subdomains for a master domain, and refresh the IPTABLES rules on a daily basis? – user1503091 Mar 8 '13 at 22:19
  • 2
    @user1503091: It's possible, but it's like trying to weld a Phillips bit on the side of a hammer so you can use it to drive screws. Sure, you can, but there already exist tools to do exactly what you want. At the end of the day you're using an IP layer device to work on the Application layer. You can blacklist domains in your DNS server. Or in a proxy. Or one of those new fangled NGFW. All tools made to do exactly what you want. – Scott Pack Mar 8 '13 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.