Linux – dropping all requests for a specific domain

iptableslinuxport-forwardingPROXY

I'm on a simple linux proxy. I'd like to add iptable rules to drop all requests for a specific domain. I figured I run a dig command to get the ip addresses for the domain and then add an iptable rule for each one. It seems, however, that it doesn't work to bind to more than one ip address. So, it seems I need to add ip ranges like this…

iptables -I FORWARD -p tcp -m iprange --dst-range 66.220.144.0-66.220.159.255 --dport 443 -j DROP

That seems to work. However, it has proven pretty problematic to parse the output of dig and correctly create the appropriate iptable rules. Is there a better way?

Best Answer

You can specify hostnames in iptables commands which will get resolved at rule-add time. Hostnames which resolve to multiple IPs are also supported, although they generate multiple rules.

% sudo iptables --append FORWARD --protocol tcp --destination www.google.com --dport 443 --jump DROP
% sudo iptables -nL FORWARD
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  0.0.0.0/0            74.125.224.147       tcp dpt:443
DROP       tcp  --  0.0.0.0/0            74.125.224.145       tcp dpt:443
DROP       tcp  --  0.0.0.0/0            74.125.224.148       tcp dpt:443
DROP       tcp  --  0.0.0.0/0            74.125.224.144       tcp dpt:443
DROP       tcp  --  0.0.0.0/0            74.125.224.146       tcp dpt:443
Related Topic