Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a DDWRT router with a NAS behind it. The NAS runs a service called Cloud Station. I'd like to restrict access to Cloud Station to a handful of hosts (family members). Each family member has an IP, but they are all dynamic (Comcast ISP) so I'd like to use DynDns which I've already setup.

I understand that I can setup restricted port forwarding with iptables (or using the DDWRT gui), but since the source IP may change, can I just use a dyndns hostname instead? If not, does anyone know a script I can run that can update the allowed IP?

share|improve this question

iptables, which DD-WRT uses for firewalling and port forwarding, only sees IP addresses. It does not do DNS lookups when a packet is received. This is a really bad idea for speed and security reasons. So it doesn't ever know that IP reverse-resolves to mydomain.invalid, for example.

Probably the most elegant way to solve your issue is to use a VPN, either OpenVPN or PPTP. Now I've never really tried to get DD-WRT working with either (typically I have OpenVPN running on a separate box) but if your DD-WRT router has enough flash for a full build (8MB or more) you could try using OpenVPN on it, or PPTP if you want something simpler for your family.

So then basically you are moving from trying to do security based on IP address/domain name to security based on VPN password, which will work better for your situation.

Read more: PPTP on DD-WRT, OpenVPN on DD-WRT.

share|improve this answer
up vote 0 down vote accepted

I ended up creating a script that would essentially update iptables automatically if the IP address changed. Here's what I came up with (fill in XXXX with IP and port)


# setup variables

# check to make sure we have enough args passed (1).
if [ $# -eq 0 ]; then
    echo "$0 hostname"
    echo "You must supply a hostname to update in iptables."

# lookup host name from dns tables using ping, if invalid hostname, dns server ip responds (
IP=`ping -c 1 ${HOST} | egrep -m1 -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'`
if [ "${IP}" = "" ]; then
    echo "Couldn't lookup hostname for $HOST, failed."

# check if hostfile exists (-e) and if so, read the contents
if [ -e $HOSTFILE ]; then
    echo "CAT returned: $?"

# has address changed?
if [ "$OLDIP" == "$IP" ]; then
    echo "Old and new IP addresses match."

# save new ip to host file.

echo "Updating $HOST in iptables."
if [ "${#OLDIP}" != "0" ]; then
    echo "Removing old rule ($OLDIP)"
    `${IPTABLES}  -t nat -D PREROUTING -p tcp -s ${IP} -d $(nvram get wan_ipaddr) --dport XXXX -j DNAT --to 192.168.1.XXXX:XXXX`
    `${IPTABLES} -D FORWARD -p tcp -s ${IP} -d 192.168.1.XXXX --dport XXXX -j ACCEPT`
echo "Inserting new rule ($IP)"
# route and forward all traffic from ip XXXX to port XXXX
`${IPTABLES}  -t nat -I PREROUTING -p tcp -s ${IP} -d $(nvram get wan_ipaddr) --dport XXXX -j DNAT --to 192.168.1.XXXX:XXXX`
`${IPTABLES} -I FORWARD -p tcp -s ${IP} -d 192.168.1.XXXX --dport XXXX -j ACCEPT`
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .