0

I would like to know if it's possible ignore the errors in the restoring procedure.

I have in my rules lot of lines like:

-A mychain -s somehost.com -j DROP

My rules comes from dynamic lists and it could happen that if somehost.com is temporarly offline, not routable or something like that iptables-restore refuses to restore the rules and throws out errors like:

iptables-restore v1.6.0: host/network 'somehost.com' not found
Error occurred at line: 342
Try 'iptables-restore -h' or 'iptables-restore --help' for more information.

Well I would like that iptables could just ignore the somehost.com line if the host is not reachable.

Can this being done adding some flags to iptables-restore?

  • iptables does not care whether a host is reachable just whether the name can be resolved to an IP address. – Hauke Laging Oct 7 '17 at 16:42
2

It's possible to use DNS name in iptables rules but it is not a best practice for more reasons. And the major reason - iptables performs resolving once during rules loading. In future DNS name may be changed and your host will not know it.

As you could know iptables need only successfull DNS name resolving. So if DNS name does not exist rules loading ends with errors.

You may create script and check name resolving inside of it:

#!/bin/bash

host_check=$( dig -t A somehost.com +short 2>/dev/null | wc -l )

if (( $host_check > 0 ))
        then sed -i '/.*somehost\.com/s/^#//' file
        else sed -i 's/.*somehost\.com/#&/' file
fi

this script check name resolving. If name are resolved (output will be one or more lines) script delete comments in each lines with certain DNS name. If not - scipt add comments to each line with DNS name.

file - this is iptables script from iptables-save > file command

After this checks you can load rules with iptables-restore < file


I strongly recommend to not using this approach. You need to find a way to refuse of DNS names in iptables rules.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.