Is there a way to use hostnames in firewall rules rather than ip ? There are some guides in google but wanted to ask here.
Is there a way to use hostname in firewall rules?
- Thread starter ozgurerdogan
- Start date
I have found, modified, tested and succeed using following script. I am sure it will help someone elses.
Code:
#!/bin/bash
# Keyword is # Dynu in host.fw file. So change accordingly.
# crontab -e : */30 * * * * sh /updateip.sh
# You can use https://www.dynu.com/ service free.
HOSTNAME=YOUR-DYNAMIC-HOSTNAME
NODENAME=YOUR-NODE-NAME
CURRENTIP=/currentip.log
Current_IP=$(host $HOSTNAME | cut -f4 -d' ')
if [ $CURRENTIP = "" ] ; then
sed -i '/# Dynu/c\IN ACCEPT -source '"$Current_IP"' # Dynu ' /etc/pve/nodes/$NODENAME/host.fw
echo $Current_IP > $CURRENTIP
else
Old_IP=$(cat $CURRENTIP)
if [ "$Current_IP" = "$Old_IP" ] ; then
echo IP address has not changed
else
sed -i '/# Dynu/c\IN ACCEPT -source '"$Current_IP"' # Dynu ' /etc/pve/nodes/$NODENAME/host.fw
echo $Current_IP > $CURRENTIP
echo iptables have been updated
fi
fi
Last edited:
I am sure @fireon has had something different in his mind, but I have a problem too with using names in firewall rules.
When the packet filter script starts there may be limited network connectivity - because the "firewall" is not up and running yet --> there is NO DNS reachable yet ;-)
My personal workaround is to either put specific must-come-from-DNS rules in a post-run script or utilize ip-sets, which can get created being empty and filled with IP addresses (from DNS) later.
Under all circumstances I want my router / packet filter to be able to start successfully while all DNS servers are NOT available for whatever reason.
How do I know? Been there, done that :-(
When the packet filter script starts there may be limited network connectivity - because the "firewall" is not up and running yet --> there is NO DNS reachable yet ;-)
My personal workaround is to either put specific must-come-from-DNS rules in a post-run script or utilize ip-sets, which can get created being empty and filled with IP addresses (from DNS) later.
Under all circumstances I want my router / packet filter to be able to start successfully while all DNS servers are NOT available for whatever reason.
How do I know? Been there, done that :-(
I, too, have been using firewalls with FQDNs/hostnames instead of IP addresses in rules for a very long time. It's very convenient. You make a change in the DNS, and it updates everywhere. But what if the DNS server is compromised? Or if the DNS is manipulated in other ways...? If you use only IP addresses, this is irrelevant, at least for this particular use case.
And as @UdoB says, using DNS adds yet another dependency for the functionality, even if you use more than one DNS server for it.
If I've misunderstood something, please let me know.