Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is a practical way to manage a whitelist of firewall outgoing connection rules for http://security.debian.org (on a server that blocks all outgoing connections by default)?

My understanding is that security.debian.org is a CNAME to several mirror IPs, and it is advisable to use only IP addresses (not hostnames) in firewall rules.

At the moment I simply add newly resolved IPs to security.debian.org to my firewall (ufw) outbound rules as I discover them. However this is cumbersome and doesn't allow for automated apt-get updates.

Can anyone suggest a better way?

PS: I found the following page somewhat relevant but it did not provide a solution: http://www.debian.org/doc/manuals/securing-debian-howto/ap-fw-security-update.en.html

share|improve this question
up vote 1 down vote accepted

The real solution would be to check all DNS resolving actions. If you can make the (local) DNS server (which is used by the restricted system) log all activities then you can grep all inquiries for security.debian.org, compare the result to your list of IPs and update the firewall in case the IP is new. That's probably not fast enough for the first connection try but should not cause problems.

An alternative would be to configure a static resolution of this FQDN (either in /etc/hosts or in the DNS server) and allow the configured addresses only. From time to time you would resolve this FQDN externally and update the local configuration if necessary.

share|improve this answer
Thanks for the advice Hauke. I'll try the /etc/hosts option on the local machine first, as I am using Google DNS servers rather than a local DNS server. I appreciate your help. – Toby Jun 3 '13 at 14:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.