Hi. I have to configure a DNAT rule in Shorewall with a DNS hostname as destination of the DNAT, because the destination host could be changed sometimes, but the port needs to be the same. If I configure a DNAT rule using a DNS hostname (for example "myhost.mylan.local:12345", Shorewall query the DNS server at the startup only or everytime there is a packet to be natted? If I change the IP address of that DNS record, have I to restart Shorewall? Thank you very much! Bye. ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
shacky wrote:> Hi. > > I have to configure a DNAT rule in Shorewall with a DNS hostname as > destination of the DNAT, because the destination host could be changed > sometimes, but the port needs to be the same. > If I configure a DNAT rule using a DNS hostname (for example > "myhost.mylan.local:12345",Netfilter (and hence Shorewall) doesn''t support specifying a DNS name as the server in a DNAT rule. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
shacky wrote:> Hi. > > I have to configure a DNAT rule in Shorewall with a DNS hostname as > destination of the DNAT, because the destination host could be changed > sometimes, but the port needs to be the same. > If I configure a DNAT rule using a DNS hostname (for example > "myhost.mylan.local:12345", Shorewall query the DNS server at the > startup only or everytime there is a packet to be natted? > If I change the IP address of that DNS record, have I to restart Shorewall? >Yes, the rule will contain the IP only. Apart from that you might want to hardcode so that DNS-failure will not let your shorewall startup fail also, and you also make DNS-spoofing attacks during shorewall startup useless. roman PS: I have a cron job running that checks the DNS of relevant IPs every day and sends me notification about changes. Then I check and if seems ok, take the new IP> Thank you very much! > Bye. > >------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
DI Roman Fiedler wrote:> shacky wrote:> PS: I have a cron job running that checks the DNS of relevant IPs every > day and sends me notification about changes. Then I check and if seems > ok, take the new IPSince this is apparently an internal system, I suggest that the DHCP server be configured to always give the target system the same IP address. That''s what I do here -- I use DHCP but the assigned addresses are effectively static. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/