LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-16-2015, 07:50 AM   #1
janve
LQ Newbie
 
Registered: Aug 2003
Distribution: Slackware
Posts: 16

Rep: Reputation: 1
Name resolution not working in iptables command ?


Hi *,

I try to use a hostname (in place of an IP address) in an iptables command (iptables 1.4.20, slackware64-14.1):
Code:
me@here:~# iptables -t nat -A PREROUTING -p tcp --dport 5678 -j DNAT --to myhost
iptables v1.4.20: Bad IP address "myhost"

Try `iptables -h' or 'iptables --help' for more information.
while (e.g.)
Code:
me@here:~# iptables -A FORWARD -d myhost
works fine. Is there something that I missed ? Is it a feature ? Do I have some chance ?

Thanks for help, Jan
 
Old 08-16-2015, 09:36 AM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,162

Rep: Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268
Hostnames don't necessarily translate into a single IP so when a function takes an IP there is no reason for it to accept a hostname instead. That said, good luck trying to find detailed, up to date docs on iptables.
 
Old 08-16-2015, 05:00 PM   #3
salasi
Senior Member
 
Registered: Jul 2007
Location: Directly above centre of the earth, UK
Distribution: SuSE, plus some hopping
Posts: 4,070

Rep: Reputation: 897Reputation: 897Reputation: 897Reputation: 897Reputation: 897Reputation: 897Reputation: 897
Quote:
Originally Posted by janve View Post
I try to use a hostname (in place of an IP address) in an iptables command (iptables 1.4.20, slackware64-14.1):
[CODE]me@here:~# iptables -t nat -A PREROUTING -p tcp --dport 5678 -j DNAT --to myhost
iptables v1.4.20: Bad IP address "myhost"
I'm probably being a bit dumb here, but I have no reason to think that should work... I'm not sure when iptables would do the name resolution.

If it happened at rule initialisation/instantiation, the you are assuming that DNS resolution can happen (potentially) that early on, which it probably can't (you know, you are assuming that enough of networking works for DNS to be ok, and as you are setting uop part of networking at the time, that seems optimistic, and if you have a DNS caching service, that may not be up yet, either).

If you assume that it happens when the rule is actually used, that could be problematic, too. Depending on what exactly you are doing, a lot of traffic might hit this rule, and if it does a resolve every time, that would probably bring the box to its knees quite easily with high levels of traffic. On the other hand that would at least avoid the issue of the IP <-> hostname mapping changing partway through, an issue that can't really be ignored if there is a long uptime (and shouldn't really be ignored, even with a short uptime - what would you expect to happen if this changed (and could that happen, and would it be what most people expect)?).

Quote:
Originally Posted by janve View Post
Code:
me@here:~# iptables -A FORWARD -d myhost
works fine.
If I am surprised by anything, it is that this works. Presumably, it stops working as soon as the IP changes (ie, it still holds on to the old IP).

One possibility could be, if you create your iptables rules from a bash scriipt, to try to look up the translation from there. Of course, you'd still have to concern yourself about the potential problems listed earlier. But, you would have the chance to set up a basic set of rules early, and set up the myhost stuff later, if that helps.

@smallpond
Quote:
That said, good luck trying to find detailed, up to date docs on iptables.
Not sure about up-to-date-ness, but this is pretty detailed on iptables. Modules are another matter, however. The man page ought to be up to date (it is a bug if it isn't), and is one of the better manpages. But, sometimes, a man page isn't enough, or is just too dense...

Last edited by salasi; 08-16-2015 at 05:02 PM.
 
Old 08-16-2015, 09:53 PM   #4
janve
LQ Newbie
 
Registered: Aug 2003
Distribution: Slackware
Posts: 16

Original Poster
Rep: Reputation: 1
Thanks to both smallpond & salasi for their interest.

Quote:
good luck trying to find detailed, up to date docs on iptables
Not that bad (I think): cf. http://ipset.netfilter.org/iptables.man.html.

Quote:
I have no reason to think that should work...
Why not ? As long as I know what I'm doing :-) - cf. sections on -s, -d and -A in iptables documentation linked above.
In my case, I'm simply lazy to remember the IP addresses that are normally resolved through /etc/hosts. It's no big deal, but I did expect name resolution to work here.

Quote:
Quote:
Code:
me@here:~# iptables -A FORWARD -d myhost
works fine.
If I am surprised by anything, it is that this works. Presumably, it stops working as soon as the IP changes (ie, it still holds on to the old IP).
Yes - it does exactly that: it resolves the hostname and introduces a rule with the IP address.


Thanks, Jan

Last edited by janve; 08-17-2015 at 04:25 AM. Reason: clarity
 
Old 08-17-2015, 08:56 AM   #5
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,162

Rep: Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268Reputation: 1268
I stand corrected. I have bookmarked the tutorial by Oskar Andreasson which seems quite complete.
 
  


Reply

Tags
iptables, nat, slackware 14.1


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables packet filtering issue ? How iptables working. pradiptart Linux - Networking 3 02-13-2014 01:16 AM
iptables error in android: iptables-save and iptables-restore not working preetb123 Linux - Mobile 5 04-11-2011 01:56 PM
An error occured getting IPtables status from the command /etc/rc.d/init.d/iptables s CrazyMAzeY Linux - Newbie 10 08-12-2010 05:25 AM
iptables name resolution dlublink Linux - Networking 3 12-25-2008 01:11 PM
IPTables logging with domain resolution? SlowCoder Linux - Security 2 11-15-2007 11:36 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:37 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration