Hi, I am hoping that someone can explain the role that DNS has in relation to iptables and if there is a way to stop iptables from resolving.
I have a network where a netscreen firewall sits in front or our servers. We map public IPs to the servers and do initial port filtering from the netscreen. We also want to have each machine filter just in case the windows box gets compromised ;). It has seemed to me that iptables will not first use /etc/hosts to resolve but will go straight to the DNS server. Is this a valid statement? nsswitch.conf lists file first. Since DNS will resolve the server to a public address but it is actually on a private address, iptables get confused and the net result is long delays on ssh and ftp logins and server time outs on DNS queries. To test my theory I set the DNS record to the private ip and that worked like a champ. I feel that I am left with only the option to create views in bind. Has anyone else out there seen this or know of a better solution? Thanks in advance, Brian
