Simple iptables quesiton

cbidwell · 02-14-2007, 10:46 AM

Hi all, I've got a simple iptables question.

Is there a way that I can enter an entire "domain" into iptables to either allow or deny over a specific port?

Similar to this in hosts.allow:
sshd : .qwest.net : allow

An iptables rule?
-A RH-Firewall-1-INPUT -s .qwest.net -m tcp -p tcp --dport 22 -j ACCEPT

But this is not accepted in iptables. I'd like to use the name and not the ip that way it will deny
a client that is not in our DNS records.

Any ideas?

Thanks,
Chris

Capt_Caveman · 02-14-2007, 11:12 AM

Try the rule without the '.' in front of the domain name:

Code:

-A RH-Firewall-1-INPUT -s qwest.net -m tcp -p tcp --dport 22 -j ACCEPT

cbidwell · 02-16-2007, 12:36 PM

Hi all again,

That doesn't seem to work the same. It assumes one IP address. I'd like to be able to include a whole class B or class C subnet without denoting the actual subnet. As I mentioned previously in the hosts.allow

.qwest.net

or

.gps.caltech.edu

etc.

friendklay · 02-17-2007, 12:19 PM

Quote:

Originally Posted by cbidwell

Hi all again,

That doesn't seem to work the same. It assumes one IP address. I'd like to be able to include a whole class B or class C subnet without denoting the actual subnet. As I mentioned previously in the hosts.allow

.qwest.net

or

.gps.caltech.edu

etc.

I have a similar query, so I am hijacking on your thread. What I have is apache listening on port 443, and I have only one IP. I also need to get SSH on port 443 (ISP blocks 22 and any other ports). What I tried was the following rule:

Code:

iptables -t nat -A PREROUTING -i eth0 -p tcp -d shell.mydomain.com --dport 443 -j REDIRECT --to-port 22

However, the rule is working on the IP and not on the name (that is shell.mydomain.com). I need IP table to port forward based on name rather than IP. Any solutions?

win32sux · 02-18-2007, 04:24 AM

Quote:

Originally Posted by friendklay

I have a similar query, so I am hijacking on your thread. What I have is apache listening on port 443, and I have only one IP. I also need to get SSH on port 443 (ISP blocks 22 and any other ports). What I tried was the following rule:

Code:

iptables -t nat -A PREROUTING -i eth0 -p tcp -d shell.mydomain.com --dport 443 -j REDIRECT --to-port 22

However, the rule is working on the IP and not on the name (that is shell.mydomain.com). I need IP table to port forward based on name rather than IP. Any solutions?

friendklay, please start your own thread for this question.

I'd suggest the Linux - Networking forum. Thanks.