Re: Restricting source with dDNS (dynamic DNS)

Hi,

On Fri, Dec 18, 2009 at 03:40:36PM +0000, Jim Flowers wrote:
> To lock down services (particularly ssh) as tightly as possible, I like to allow
> administrative access to a firewall only from specific ip addresses.
> 
> Unfortunately, some of the administrators are working from dynamic ip addresses
> that change with some frequency.
> 
> Is there a straightforward way to incorporate dynamic ip source addresses in the
> pf ruleset?

- Use a table for these IP src addresses in your pass rule
- Run regularly via cron a script to resolve these dynamic IPs and
  add/modify/delete it in the src table via 'pfctl'

A++ Laurent