0

I'd like to accomplish an egress filter on Linux using Netfilter (iptables) and the DNS hostname of the destination. The problem is, writing the rules using the hostname will only resolove the IP addresses when the rules are loaded.

To further complicate the matter, if the destination is load balanced or redirects to a cluster, these IP addresses are not allowed egress.

For instance, If I add an allowed egress rule for a Ubuntu package repo such as:

iptables -A OUTPUT -p tcp -d packages.project.org -m multiport --dports 80,443 -j ACCEPT

Netfilter will add several IPs such as packages.project.org.herokudns.com which resolve to something like 34.x.x.x, 35.x.x.x, 44.x.x.x, 38.x.x.x

when I perform an apt update on this host, it fails with: 100% [Connecting to project-package-repository.s3.eu-west-1.amazonaws.com (51.xxx.xxx.xxx)] and is quickly blocked.

Is there a way to make Netfilter see this destinations as "allowed" when connecting to the original repo?

Improve this question
8
  • For me, packages.project.org resolves to the single IP address 206.188.192.100. No matter which root server(s) I use, that seems to be the only address I'm offered Commented Dec 15, 2021 at 13:52
  • Use ipset or dedicated chain that can be flushed and replaced regularly. Commented Dec 15, 2021 at 13:56
  • Also apt does make use of SRV entries in DNS (contrary to a web browser) to complicate things, but packages.project.org doesn't have such entry. Commented Dec 15, 2021 at 13:58
  • @A.B - Have tried the dedicated chain route updated via cron in the past and just always felt there must be a better way to do it. I've never used ipset. I'll look into that. Thanks. @roaima - packages.project.org was just an example. Probably didn't need to be redacted but just a habit. Commented Dec 15, 2021 at 14:01
  • consider this dns answer: dig _http._tcp.deb.debian.org. -t srv => _http._tcp.deb.debian.org. 294 IN SRV 10 1 80 debian.map.fastlydns.net . In some cases the final IP result with -t srv might differ from the result of dig some.debian.url -t a (or -t aaaa). Commented Dec 15, 2021 at 14:03

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.