Is there anything I can do to change iptables from ddclient (with user ddclient)?

The story behind

I have a computer that uses dyndns to be addressable from outside. Whenever the provider issues a new ip address (which happens quite often these days) ddclient updates the dns entry.

The computer has some iptables rules based on its public IP which of course will only work while the IP is correct.

Up to now I had an hourly cron job that would work like this to hold iptables up to date:

./change-iptables-public-ip.sh `curl ifconfig.me/ip`

Now hourly updates meant, that there could be an hour delay where iptables is configured with the wrong address. I could have made the job more frequent (up to a minute), but I thought, that doing this kind of thing via polling is a waste, especially, when ddclient offers the possibility to execute a script after the ip has been changed.

So I inserted this into my ddclient config:


I also added the suid bit to change-iptables-public-ip.sh, but to no avail. When the script is executed by ddclient it results in:

iptables v1.4.18: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

I dislike the idea to run ddclient as root.

One idea I had so far was a process running as root, that listens on a socket for the new ip and then triggers the changes on iptables. But before getting my hands dirty I want to hear if there are standard solutions out there.

  • What rules are those? – user1686 May 9 '13 at 20:09
  • @grawity: Does that really matter? I am aiming for a more general solution, which could even be independent of iptables. But for the sake of completenes: I have some nat loopback on the server and therefore have some rules in the nat table that depend on the public address. – Nobody May 10 '13 at 9:32
  • Without knowing the particulars of your system or your script, this should work if you add sudo to the script. – joat Aug 19 '13 at 3:30
  • @joat: Which would then have to be automatically authorized I think. Root privileges (gained by sudo) are much to broad for this kind of task. Even access to iptables is much too broad. The idea is to have channel that allows only ddclient to alter some specific rules. For now I have settled with the process listening on a socket. – Nobody Aug 19 '13 at 13:01
  • You can configure sudo to run only your script as root (as opposed to calling IPTables as root). – joat Sep 16 '13 at 0:35

Sorry for the delay. Have been busy elsewhere...

1) Login as root and run visudo

2) Add a line which looks like:

bob ALL = (ALL) NOPASSWD: /etc/ddclient/change-iptables-public-ip.sh

where "bob" is the account which ddclient is run from (you'll likely need to experiment).

3) Edit the line in your ddclient config so that it looks like:

postscript=sudo /etc/ddclient/change-iptables-public-ip.sh

You'll likely need to kill/restart ddclient. You'll need to experiment with the above to get it where it'll work the way you want it. It may be better to embed the sudo command in your script (for specific commands) rather than running the entire script with root-level access.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.