Firewall PortForwarding Question

[Zal]

NethServer Version: 7.9
Module: Firewall / IPS

Hi

Thank you for this great tool, Its been my to go for any new homelab deployment, I have a question regarding an issue I am facing lately

I have some devices that run remotely on dynamic ip, where in the event they lost power would get a new ip or reboot. There is a way I can link these device to DDNS however I have no way to add a dynamic dns for Nethserver allow list, would only allow CDIR which is the issue I am having

Is there anyway I can lock a port forwarding allow list to DDNS instead of ips, it would be awesome if there is a way around this

Thanks for this great community and Happy Holidays

[pike (Michael Kicks)]

Firewalls, as port forwarding, don’t understand hostnames, only IPs.
Maybe some other firewall software allow to do that but introduce at least the vulnerability about DNS Poisoning. I don’t know which firewall developer would do this.

[Andy_Wismer (André Wismer)]

Hi @Zal

And welcome to the NethServer community.

One option you can use is Site2Site VPNs. These work quite well using either IPsec V2 or OpenVPN.
It can also work with Wireguard, but there’s no GUI in NethServer for that.

And yes, all three can work with DynamicDNS names.

You’ld be connected to all remote devices, and secure using VPN…

My 2 cents
Andy

PS:
Pike is right, firewalls work with IPs and Ports, not with DNS names.

[bwdjames (James Nesbitt)]

There are certain firewall models from certain firewall vendors which allows the use of hostname.

However, the preference should always be to use IP Addresses by default from a security perspective in order to prevent the obvious DNS Poisoning issue which @pike mentioned.

[dnutan (Marc)]

A cronjob that periodically checks the domain IP and changes the firewall object accordingly is another option but not the best/safer one.
Some examples:

Adding a host with dynamical IP address to firewall objects

this code looks logically correct but syntacticly a little shakey - ive updated it to the following - add your hostname myhost=‘my hostname’ myhostip=$(dig +short myhost) old=(db hosts getprop myhost IpAddress) if [ “$old” != “$myhostip” ] then db hosts setprop $myhost IpAddress $myhostip echo signal-event firewall-objects-modify fi

How to analyze who triggers fail2ban

Unrelated to fail2ban but a quick & dirty script to get the changing IP address of a domain (lets say of another of your publicly reachable hosts) could be something like this: #!/bin/bash # # Update host object IP address (to be used with firewall rules, i.e. for public domain) # (Requires: dig, ipcalc, e-smith commands) # # get IP address ip=$( /usr/bin/basename $( /usr/bin/dig +short domain.tld A | tr '\n' '/' ) 2>&- ) # validate IPv4 address if ! /usr/bin/ipcalc -c "$ip"; then exit; fi #…

But VPN is safer.

[pike (Michael Kicks)]

@dnutan

But VPN is safer.

And it’s easier to track into logs.

[Zal]

Hi

Thank you all for the help, truly appreciate it

Well the concept of using the ddns would be just so it would refresh their new ip and whitelist on that port forwarding rule, I wish there would be a way around this as vpn is the current option we have, Thanks again