Linux – Using iptables to redirect traffic to a dynamic DNS name instead of an IP address

dnsiptableslinuxnetworking

I have a Debian server with a static IP address. I want to set it up so that if I connect to this server using a specific port, it will redirect that traffic to my home network.

I've got that working using iptables like so:

iptables -t nat -A PREROUTING -p tcp --dport [port] -j DNAT --to [home-ip]:[port]
iptables -t nat -A POSTROUTING -d [home-ip] -j MASQUERADE

The trouble is, my home network has a dynamic IP. As soon as it changes (which happens frequently enough) this will stop working.

However, I have a dynamic DNS name set up for my home IP address.

Is there anyway to use iptables so that it will always redirect this traffic to the IP that my dynamic DNS name resolves to?

Best Answer

IPTables does not support on-the-fly DNS resolution, because it involves security, performance and implementation issues.

If someone was able to modify DNS records for your domain, it would affect IPTables rules.

If IPTables did a DNS lookup on every incoming packet or even connection initiation packet, it would be really slow.

Also, if there are multiple A records for a domain name, which one would IPTables use?

To accomplish what you are looking for, you would need to implement a system where the host running IPTables would periodically check what is the IP address for your dynamic host name, and then change its rules accordingly.

Another alternative would be to have a software on your computer on your home network, which monitors current public IP address, and then sends it to your IPTables server, which reconfigures the IPTables.

I don't know any particular software that could do this for you.

Related Solutions

Linux – What is MASQUERADE Made For?

MASQUERADE does what the name suggests: It hides everything “behind” the host. You’d do that to supply Internet to multiple hosts when you only have one uplink IP address. This tech is used on most consumer-grade Internet access routers, dubbed “NAT”.

When host A contacts server S via MASQUERADEing router R, the server won’t be able to see the connection originates from host A. Instead, to the server it looks like it’s communicating with router R. Router R however knows this connection was originally from host A and will forward messages accordingly. Host A knows it connected to server S and that server S sent the response.

In IPTables, you’d usually use this only on the Internet-facing interface. Something like that:

-t nat -A POSTROUTING -o eth0 -j MASQUERADE

Meaning that every IP packet that was routed and leaves through eth0 will get the treatment.

When used in your example, it looks to 13.37.42.1 (host S) as if your machine (henceforth host Y) initiated the connection. That means the response will reach host Y which forwards it to the real destination (host A). To host A, it will look as if the message came from host Y. It cannot see or know that host S actually sent it, because MASQUERADE works both ways here.

If you do not use this rule, host S will see a message that originated from host A. It will thus send the response directly to host A. Host A, however, does not know host S. It connected to host Y and expects a response from there. As such, the response from host S is treated as unsolicited traffic and discarded. The connection will time out.

Best Answer

Related Solutions

Linux – What is MASQUERADE Made For?

Related Question