Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

hostnames with multiple address are not handled completely #1222

Open
ap-16 opened this issue Jun 11, 2024 · 0 comments
Open

hostnames with multiple address are not handled completely #1222

ap-16 opened this issue Jun 11, 2024 · 0 comments

Comments

@ap-16
Copy link

ap-16 commented Jun 11, 2024

Describe the Bug

firewall { '123 allow http*s to security.debian.org v4 ':
proto => 'tcp',
destination => 'security.debian.org',
dport => [80,443],
action => 'accept',
chain => 'OUTPUT',
}

configures only one IP address:

-A OUTPUT -d 151.101.130.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow http*s to security.debian.org v4 " -j ACCEPT

Expected Behavior

Configure all IPs for an hostname, thus:

-A OUTPUT -d 151.101.2.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow https to security.debian.org v4 " -j ACCEPT
-A OUTPUT -d 151.101.66.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow http
s to security.debian.org v4 " -j ACCEPT
-A OUTPUT -d 151.101.130.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow https to security.debian.org v4 " -j ACCEPT
-A OUTPUT -d 151.101.194.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow http
s to security.debian.org v4 " -j ACCEPT

Steps to Reproduce

firewall ressource above

Environment

  • Versions up to at least 8.0.2
  • Platform Debian12

Additional Context

Same is true for IPv6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants