Skip to content

hostnames with multiple address are not handled completely #1222

Open
@ap-16

Description

@ap-16

Describe the Bug

firewall { '123 allow http*s to security.debian.org v4 ':
proto => 'tcp',
destination => 'security.debian.org',
dport => [80,443],
action => 'accept',
chain => 'OUTPUT',
}

configures only one IP address:

-A OUTPUT -d 151.101.130.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow http*s to security.debian.org v4 " -j ACCEPT

Expected Behavior

Configure all IPs for an hostname, thus:

-A OUTPUT -d 151.101.2.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow https to security.debian.org v4 " -j ACCEPT
-A OUTPUT -d 151.101.66.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow http
s to security.debian.org v4 " -j ACCEPT
-A OUTPUT -d 151.101.130.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow https to security.debian.org v4 " -j ACCEPT
-A OUTPUT -d 151.101.194.132/32 -p tcp -m multiport --dports 80,443 -m comment --comment "123 allow http
s to security.debian.org v4 " -j ACCEPT

Steps to Reproduce

firewall ressource above

Environment

  • Versions up to at least 8.0.2
  • Platform Debian12

Additional Context

Same is true for IPv6

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions