iptables and dynamic DNS
I just found back an old note about using iptables in combination with dyndns to open up access from a remote location. For instance, if you have a laptop that you take everywhere and you want to connect to your home or office. The script the other site suggested was broken, so let's write a new one.
In this case, the firewall accepts all traffic from $IP, but of course you could restrict it to 1 port. Also, I focussed on IPv4, but you could easily rewrite this script to IPv6 using ip6tables. I saved the file to /usr/local/bin/dynfirewall.sh
Please don't forget the ampersand at the end to fork the script!!© GeekLabInfo
Step 1: Create a new chain in the firewall
Create a new chain in the firewall where we can plug in the dynamic rules. On my Fedora machine, the firewall is located in /etc/sysconfig/iptables. I added the bold lines to this example.
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
<b>:DYNAMIC
-A INPUT -j DYNAMIC</b>
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Step 2: Write a script
#!/bin/bash HOSTNAME=myname.dyndns.org CHECK_INTERVAL=60 #once a minute /sbin/iptables -F DYNAMIC #flush all existing rules IP="" #initialize $IP while [ true ]; do OIP=$IP IP=$(host $HOSTNAME | grep -iE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" |cut -f4 -d' '|head -n 1) if [ "$OIP" != "$IP" -a "$IP" != "" ]; then echo "Changing ip to $IP" /sbin/iptables -F DYNAMIC #flush all old rules /sbin/iptables -I DYNAMIC -s $IP -j ACCEPT #the new rule fi sleep $CHECK_INTERVAL done
Step 3: Run the script
I'd prefer running the script from inittab, but since Fedora doesn't work like this anymore, I put the following line in /etc/rc.d/rc.local:/usr/local/bin/dynfirewall.sh >>/var/log/dynfirewall 2>>/var/log/dynfirewall &
Was this page useful?
Please rate this page and/or leave a comment.
(1 votes, average: 5.00 out of 5)
Loading ...