1

I have registered with dyndns domain for my dynamically changing public ip address to use with iptable rules. On a server I've allowed some ports for this domain in the iptables configuration like the below entries:

-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 21 -j ACCEPT

But when ever my modem restarts, I couldn't connect to these allowed ports as public ip changes with modem restart and are not updated in the iptables on the server. Is there any option to automatically update iptable rules on server.

3 Answers 3

2

In short: no, the only way to update an iptables rule is to replace it (iptales -R ...) or to delete it and add a new one with the updated IP address (iptables -D ... followed by iptables -A ...).

This blog post discusses the issue and sketches a solution.

2
  • Good answer. Again I've to use script. Ok, how about if use mac address in the iptable rules
    – user3215
    Oct 13, 2010 at 9:54
  • 1
    @user3215 MAC addresses stay local to your LAN; they will not travel across internet routers. Oct 13, 2010 at 9:57
0

But when ever my modem restarts, I couldn't connect to these allowed ports as public ip >changes with modem restart and are not updated in the iptables on the server.

Even though you are applying rules with a domain name, iptables will resolve to the public IP of given domain at that moment and apply rules with that public IP. So with each modem restart or ISP IP lease time expiry, you have to update iptables with the newly allocated public IP.

If you list iptables rules, then it will be confusing as you can see rules that you applied with exact domain name.

iptables -L

To get clarity, save iptables rules to one file and verify. You can find resolved IP of your domain instead of domain name.

iptables-save > /tmp/iptables.rules
0

You can achieve what you want in many different ways. Per instance, dig your Dyndns ip:

YOURIP="$(dig yourdomain.ddns.net +short A)"

Then use the $YOURIP variable to check your IP regularly and add a firewall rule via a cron command

Dig is a well known utility for querying DNS servers, you can easily install it in your Linux distro should it not be readily available

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .