Dynamic DNS for application of iptables firewall

First, the core idea

The core idea of configuring a dynamic DNS server is to run multiple bind on a DNS server, each of which provides resolution for users from different zones, so each bind should have a different profile and domain file and be monitored separately on different ports. When a client DNS request is received, the request redirects the different bind service ports according to the client's IP address.

When Bind responds, the service port of the corresponding package is overwritten with the standard 53 port. This allows different resolution results to be returned to the client based on the IP address of the client. The entire process is transparent to the client. The key to implementation is to run different bind and use Iptables for IP address and port rewriting operations.

For more detailed information about iptables, please refer to the two articles in the solution-"Iptales firewall with the implementation of" and "Implementing NAT with Iptables".

Second, the configuration process

Step 1: Configure the kernel

NetFilter requires the kernel version to be no less than 2.3.5, and when compiling the new kernel, you need to select and NetFilter related items. These items are usually located under the Networking Options subkey. Take the 2.4.0 kernel for example, the items we should select are:

[*] Kernel/user netlink Socket!;

[] Routing messages

<*> NetLink device emulation

[*] Network packet filtering (replaces IPChains)

.......

Then, in the "Ip:netfilter Configuration---->" Check:

Connection tracking (required for Masq/nat)

FTP protocol Support

IP tables Support (required for Filtering/masq/nat)

Limit match Support

MAC Address Match Support

NetFilter MARK Match Support

Multiple Port match support

TOS Match Support

Connection State Match Support

Packet filtering

&! nbsp REJECT Target Support

Fu ll NAT

Masquerade Target Support

REDIRECT Target Support

Packet mangling

TOS Target Support

MARK Target Support

LOG Target Support

IPChains (2.2-style) support

Ipfwadm (2.0-style) support

The last two items may not be selected, but if you miss IPChains or IPFWADM, you can also select them to use Ipchians or ipfwadm in the 2.4 kernel. However, it should be noted that iptables is opposed to Ipchians/ipfwadm, in the use of iptables can not simultaneously make ipchains/ipfwadm.

After successful compilation, these module files are located in the following directory/lib/modules/2.4.0/kernel/net/ipv4/netfilter