Is there anything I can do to change iptables from ddclient (with user ddclient)?
The story behind
I have a computer that uses dyndns to be addressable from outside. Whenever the provider issues a new ip address (which happens quite often these days) ddclient updates the dns entry.
The computer has some iptables rules based on its public IP which of course will only work while the IP is correct.
Up to now I had an hourly cron job that would work like this to hold iptables up to date:
./change-iptables-public-ip.sh `curl ifconfig.me/ip`
Now hourly updates meant, that there could be an hour delay where iptables is configured with the wrong address. I could have made the job more frequent (up to a minute), but I thought, that doing this kind of thing via polling is a waste, especially, when ddclient offers the possibility to execute a script after the ip has been changed.
So I inserted this into my ddclient config:
I also added the suid bit to
change-iptables-public-ip.sh, but to no avail.
When the script is executed by ddclient it results in:
iptables v1.4.18: can't initialize iptables table `nat': Permission denied (you must be root) Perhaps iptables or your kernel needs to be upgraded.
I dislike the idea to run ddclient as root.
One idea I had so far was a process running as root, that listens on a socket for the new ip and then triggers the changes on iptables. But before getting my hands dirty I want to hear if there are standard solutions out there.