Date: Tue, 14 Jun 2016 18:16:44 +0200 From: Miroslav Lachman <000.fbsd@quip.cz> To: atar <atar.yosef@gmail.com>, freebsd-pf@freebsd.org Subject: Re: Filter connections based on the hostname. Message-ID: <57602DEC.6080201@quip.cz> In-Reply-To: <08195C33-DC97-4ADD-9C0A-D9493E2C29F7@gmail.com> References: <5858A82C-FB66-4D67-A676-47EABED976CE@gmail.com> <57600481.6080204@quip.cz> <08195C33-DC97-4ADD-9C0A-D9493E2C29F7@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
atar wrote on 06/14/2016 16:05:
>> atar wrote on 06/14/2016 14:52:
[...]
>>> The hostname "google.com" isn't blocked since its current ip differs from its previous ip when pf has loaded the rule, what can I do in order to be able to block such sites (with many ip addresses)?
>>
>> I would use tables and populate them periodically from shell script which can do FQDN to many IPs resolution.
>>
>> It can be simple as this
>>
>> host yahoo.com | awk '$0 ~ /has address/ { print $4 }' > /var/run/pf.yahoo_table
>> pfctl -t yahoo_table -T replace -f /var/run/pf.yahoo.table
>>
>> I am sure you will find better solution :)
>>
>> Miroslav Lachman
> Thanks for your answer, it is an interested idea.
>
> However, is this method of update periodically the pf tables not disturb or burden the performance of the pf filter engine especially if the script that update the tables runs too often?
How often is "too often"?
I think that updating the tables every 5 minutes is enough (no one uses
shorter TTL for DNS entries)
The nicest thing on PF tables is you don't need to reload PF and tables
can live in memory (not need for persistent file on filesystem) so all
operations are really quick.
Our PF firewalls are using tables with thousands of entries without any
issues.
I don't see any trouble even if you will update tables each minute.
Miroslav Lachman
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?57602DEC.6080201>