Hacker News Reader

Having to do a DNS lookup for each firewall rule is going to suck. Not to mention blackholing traffic when cached DNS replies are out of sync with the actual IP.

View on HN

Doesn't have to be DNS, could be any sort of cache on the router that updates when new hosts come online or the prefix changes.

Plus blackholing temporarily due to a stale cache is better than blackholing permanently due to a stale rule pointing to an old IP.

how do client firewalls deal with that?

the don't know the router lost its connection

I can see that there is a user-space daemon, that watches TTLs in the resolved DNS records and if they change, updates an corresponding ip set in the firewall.

Reply on news.ycombinator.com