Common Questions


Q:

Can you use hostnames instead of IP addresses?

A:

Yes, you can; however, when the rules are initially loaded, netfilter will perform a lookup on those names and use the IP address returned at that time. So any updates against the hostname made after the rules have been loaded will have no effect. The hard way to update this would be to write something using the iptables -R flag (replace). The -R flag, however, suffers from issues when the source and/or destination names resolved to multiple addresses. The low-tech approach to dealing with this problem is just to reload your rules.

Q:

Can firewall rules direct traffic to different systems based on the domain name?

A:

Noiptables/netfilter operates at too low of a level to do name-based rules like this. You would need to use an application layer proxy server or iproute2 to achieve this effect.



    Troubleshooting Linux Firewalls
    Troubleshooting Linux Firewalls
    ISBN: 321227239
    EAN: N/A
    Year: 2004
    Pages: 169

    flylib.com © 2008-2017.
    If you may any questions please contact us: flylib@qtcs.net