Firewall rules based on Domain name instead of IP address

Question

I am running Guacamole remote desktop gateway test setup to manage access to cloud VM instances.

As I got one strange POC request from one client to restrict Guacamole RDG access to one specific domain which doesn't have static IP, I am out of options. Client might be using services like dynamic DNS to have their domain resolve back to whatever dynamic IP they get.

So basically I have to set inbound Firewall rules in my Guacamole RDG server based on one domain name instead of IP address. Apart from basic networking logic, is there any way to achieve this requirement?

I tried below command to set iptables rule based on domain name but upon execution, it actually resolve domain name and apply rule to iptables with resolved IP address.

iptables -A INPUT -p tcp --src domain.com --dport 3128 -j ACCEPT

Answer 1

iptables itself only works with IP addresses, but you can create an ipset-based rule and update the ipset periodically.

ipset create allowed hash:ip family inet     # IPv4-only
ipset create allowed6 hash:ip family inet6   # IPv6-only

Note that all ipsets will be destroyed upon reboot by default.

The rules will then look like this:

iptables -A INPUT -p tcp --dport 3128  -m set --match-set allowed src -j ACCEPT
ip6tables -A INPUT -p tcp --dport 3128  -m set --match-set allowed6 src -j ACCEPT

(as a footnote, for FORWARD and OUTPUT chains, src will need to be replaced with dst)

Create a script to do domain lookup and update the ipset.

#!env /bin/bash

# Domain names to look up
names=("example.com" "example.org")

ipset flush allowed
for name in ${names[@]}; do
    # Look up and add IPv4 addresses (dig may output multiple)
    ip4s=$(dig A +short ${name})
    for ip4 in ${ip4s}; do
        ipset add allowed ${ip4}
    done
    
    # Look up and add IPv6 addresses (dig may output multiple)
    ip6s=$(dig AAAA +short ${name})
    for ip6 in ${ip6s}; do
        ipset add allowed6 ${ip6}
    done
done

Add a cronjob to execute the script periodically. For example, every 5 minutes:

*/5 * * * * root /path/to/myscript.sh

Answer 2

ipset add allowed $ip

did not work for me because dig responded with 4 IPs. Did this instead:

for n in $ip
do
  ipset add allowed $n
done

Answer 3

CSF firewall has this feature embedded. So you can lock down inbound to just a single source even. And have a (cheap, but hopefully secure) dynamic DNS service updating the IP to a given subdomain. CSF will check periodically and change the allowed inbound IP. It works very, very well. Very low maintenance. I use to lock access to a VPS. It seems this should be a very popular thing, but it's very difficult to find much info on it. So was glad to learn about CSF. Which by the way can be configured easily in Webmin. Also it is free. And popular. A little tricky to set up depending on what distro you are using if various paths are different. https://www.configserver.com/cp/csf.html

Answer 4

All commercial firewalls allow this for very good reason. Sometimes you want to deny everything from an entire domain… you would put these rules lower down the list after explicit ports and ips , but the fact that Linux firewalls don’t allow this means the people who made these firewalls have never been firewall admins at an enterprise level. You should look at the commercial firewalls as they ALL allow this behavior.