Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running a DDWRT router with a NAS behind it. The NAS runs a service called Cloud Station. I'd like to restrict access to Cloud Station to a handful of hosts (family members). Each family member has an IP, but they are all dynamic (Comcast ISP) so I'd like to use DynDns which I've already setup.

I understand that I can setup restricted port forwarding with iptables (or using the DDWRT gui), but since the source IP may change, can I just use a dyndns hostname instead? If not, does anyone know a script I can run that can update the allowed IP?

share|improve this question

2 Answers 2

iptables, which DD-WRT uses for firewalling and port forwarding, only sees IP addresses. It does not do DNS lookups when a packet is received. This is a really bad idea for speed and security reasons. So it doesn't ever know that IP xxx.xxx.xxx.xxx reverse-resolves to mydomain.invalid, for example.

Probably the most elegant way to solve your issue is to use a VPN, either OpenVPN or PPTP. Now I've never really tried to get DD-WRT working with either (typically I have OpenVPN running on a separate box) but if your DD-WRT router has enough flash for a full build (8MB or more) you could try using OpenVPN on it, or PPTP if you want something simpler for your family.

So then basically you are moving from trying to do security based on IP address/domain name to security based on VPN password, which will work better for your situation.

Read more: PPTP on DD-WRT, OpenVPN on DD-WRT.

share|improve this answer
up vote 0 down vote accepted

I ended up creating a script that would essentially update iptables automatically if the IP address changed. Here's what I came up with (fill in XXXX with IP and port)

#!/bin/sh

# setup variables
HOST=$1
HOSTFILE="/tmp/root/hosts/host-$HOST"
IPTABLES="/usr/sbin/iptables"

# check to make sure we have enough args passed (1).
if [ $# -eq 0 ]; then
    echo "$0 hostname"
    echo "You must supply a hostname to update in iptables."
    exit
fi

# lookup host name from dns tables using ping, if invalid hostname, dns server ip responds (67.215.65.132)
IP=`ping -c 1 ${HOST} | egrep -m1 -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'`
if [ "${IP}" = "67.215.65.132" ]; then
    echo "Couldn't lookup hostname for $HOST, failed."
    exit
fi

# check if hostfile exists (-e) and if so, read the contents
OLDIP=""
if [ -e $HOSTFILE ]; then
    OLDIP=`cat $HOSTFILE`
    echo "CAT returned: $?"
fi

# has address changed?
if [ "$OLDIP" == "$IP" ]; then
    echo "Old and new IP addresses match."
    exit
fi

# save new ip to host file.
echo $IP>$HOSTFILE

echo "Updating $HOST in iptables."
if [ "${#OLDIP}" != "0" ]; then
    echo "Removing old rule ($OLDIP)"
    `${IPTABLES}  -t nat -D PREROUTING -p tcp -s ${IP} -d $(nvram get wan_ipaddr) --dport XXXX -j DNAT --to 192.168.1.XXXX:XXXX`
    `${IPTABLES} -D FORWARD -p tcp -s ${IP} -d 192.168.1.XXXX --dport XXXX -j ACCEPT`
fi
echo "Inserting new rule ($IP)"
# route and forward all traffic from ip XXXX to port XXXX
`${IPTABLES}  -t nat -I PREROUTING -p tcp -s ${IP} -d $(nvram get wan_ipaddr) --dport XXXX -j DNAT --to 192.168.1.XXXX:XXXX`
`${IPTABLES} -I FORWARD -p tcp -s ${IP} -d 192.168.1.XXXX --dport XXXX -j ACCEPT`
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.