3

I have an ubuntu server which only allows traffic on a select group of ports via iptables. One of the ports that is set to REJECT by default is 53.

I need to periodically open port 53 to run an instance of acme-dns to authenticate DNS-01 challenges from LetsEncrypt, then close it when finished.

Is there an easy way this can be automated? I know how to easily automate adding a rule via iptables -I to insert an ACCEPT for udp traffic 53 at the top of the list, but the only way I know how to disable a particular rule is to list all active rules with line numbers and disable the particular rule by line number. That requires manual interaction on my part.

I need remove that rule, and not undo it by inserting a REJECT before it, because this will be run by a cron job and I don't want pollute the rules with a bunch of ACCEPT/REJECT toggles that undo one another.

The only approach I can think of is to write a script that prints the rules by line number, analyzes them, then drops the matching rule. Is there a way to do this simply with an iptables command that I don't know of?

1 Answer 1

5

Rules can be managed more easily by using an user-defined chain.

Create a chain:

iptables -N acme-dns

Call this chain with this command run at the right place in the iptables script, before the REJECT rule for port 53:

iptables -A INPUT -j acme-dns

Normally this chain is empty and there's no effect. When access to acme-dns is needed, this command can be run (it could be more precise, but that's not the point here):

iptables -A acme-dns -p udp --dport 53 -j ACCEPT

When access is not needed anymore, the chain's content can be flushed. Even if for some reason the previous command was added multiple times, this will anyway flush all entries:

iptables -F acme-dns

For this simple case, that's really all that is needed. For complex cases involving a lot of dynamic changes to values (ports, ips...) but not rules, the set match module and ipset can help for performance and management.

1
  • 1
    brilliant! i did not think of a custom chain. thank you! Apr 1, 2018 at 4:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .