Colocation to Virtualization

This is quick and a little basic, but most people do not actually read the “man pages” or documentation.  The majority of the time, requests for access comes in specifying IP address instead of hostnames (FQDN).  I actually prefer this, but when doing a typical “iptables -L”, the reverse DNS is automatically checked for all IPs.

Most of the time I do not actually know the hostname that is associated and makes it hard to confirm the rule without doing a dns lookup on my own.  Below is the typical output of the command.
[root@testserver ~]# iptables -L

Chain Firewall-INPUT
(2 references)
target     prot opt source               destination
ACCEPT     tcp  --  mail.asdf.com        anywhere            tcp dpt:ssh
ACCEPT     tcp  --  static.123.net       anywhere            tcp dpt:ssh
ACCEPT     tcp  --  private.9z.com       anywhere            tcp dpts:ftp-data:ftp
ACCEPT     tcp  --  nto.ntpgr.com        anywhere            tcp dpts:ftp-data:ftp

Iptables has a built in option to disable DNS resolution.  This is done by passing “-n” in conjunction with “-L” and shown below.

[root@testserver ~]# iptables -L -n
Chain Firewall-INPUT
(2 references)
target     prot opt source               destination
ACCEPT     tcp  --  10.1.129.119         0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  172.168.22.87        0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  172.33.100.2         0.0.0.0/0           tcp dpts:ftp-data:ftp
ACCEPT     tcp  --  10.90.15.104         0.0.0.0/0           tcp dpts:ftp-data:ftp

Above you can see how easy it would be to verify the rules now without knowing the hostname or performing a lookup on your own.

Notes:  The iptables output was edited to remove non-relevant information and all IPs/hostnames were changed.

~ by Kevin Goodman on June 2, 2009.

Posted in Linux, Networking, Security
Tags: chain, disable, DNS, dns resolution, iptables, iptables -L -n, iptales -L, LinkedIn, Linux, reverse dns, rule, Security