0

I would like to restrict the outbound access of my device to a single domain name, let's say abc.com. How can I do that?

Device needs to resolve the domain name to an IP address which might change depending on the server load. I am ok with allowing DNS access + a single domain.

Seems like iptables can accept hostname but that wouldn't be dynamic in case the IP address of the hostname changes. I don't even know if there is a hostname support in nftables.

I was wondering what options do I have.

1
  • You may be aware of this already, but it's worth mentioning that some websites are hosted behind a DNS load balance. This may mean that each time a client requests an IP they will be given a different IP address. Caching in the client will slow down the change but such websites would make this type of limit pretty tricky. Jun 23, 2020 at 16:26

1 Answer 1

0

As a starting point:

/sbin/iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
/sbin/iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

Then you add this crontab job (you can run it every minute if you desire):

#! /bin/bash

dig +short abc.com | while read address; do
    if [ -z "`/sbin/iptables-save | grep "$address"`" ]; then
        /sbin/iptables -A OUTPUT -d "$address" -p tcp -m tcp --dport 80  -j ACCEPT
        /sbin/iptables -A OUTPUT -d "$address" -p tcp -m tcp --dport 443 -j ACCEPT
    fi
done

This is totally untested but should work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.