Hostname or DNS-based network objects are network objects where the IP addresses are determined by DNS resolution. This is useful if you must create access rules where the source or destination are dynamically assigned IP addresses. The firewall service resolves the hostnames in the network object. However, there are limitations on the number of hostnames in the object. Although the network object can contain multiple DNS hostnames which will all be resolved, only the first 16 IPv4 entries will be handled by the firewall. The same applies for IPv6. That means the firewall uses a maximum of 32 IP addresses, up to 16 IPv4 and up to 16 IPv6 addresses.

These IP addresses are then used by the firewall service when matching traffic against access rules using hostname network objects.

If the hostname is finally still not resolvable, the access rule never matches. Hostname network objects can be used in both the host and forwarding firewall rule sets. Creating hostname network objects directly in the access rule using explicit is not possible.

Limitations and Drawbacks

There are several limitations and drawbacks to using hostnames in network objects:

• The firewall itself must be able to resolve the DNS entries. For more information, see How to Configure DNS Settings.

• Only explicit host names can be used. e.g., http://www.barracuda.com.

• The IP addresses are entered into the network object in the order they are encountered in the DNS response.

• To use more than 512 hostname network objects, you must increase the Max DNS Entries in the General Firewall configuration.

• Using a hostname network object in a BLOCK access rule is not recommended because the rule will never match if the DNS server is not available or if the hostname is not resolvable.

• When a non-resolvable object is used in a rule, rules cannot be matched or processed correctly. Hostname objects become non-resolvable when they refer to a non-existent hostname or the DNS server is unavailable.

• Active sessions are not re-evaluated when DNS resolution changes; sessions are re-evaluated only when the rule itself is modified. To establish new connections with updated DNS entries, you must manually terminate persistent sessions on the Firewall > Live page.

• The time it takes to work work through this initial bulk of required hostname resolutions depend on a few factors:

  • The total number of DnsObjects (the more, the longer)

  • The Time To Live (TTL) of DnsOjbects (the shorter, the longer, because they might time out in the middle of the entire process)

  • The performance/load of the resolving dns servers (but also of the firewall itself)

  • The potential “thundering herd protection” (a DNS server might ignore our DNS queries for a short time due to the big initial burst of queries. After that, resolution goes back to normal).

• If a client’s DNS query is answered with a different set of IPs within the TTL of the DNS Record that is known to the firewall, it is very likely that a wrong rule is matched. This can happen due to, for example, load balancing via DNS.

• If a DNS response contains both A and AAAA records with different TTLs, the shorter TTL determines the TTL of the network object as a whole.

• Network objects that are known to be unresolvable (i.e. an internal hostname is permanently no longer available), should be deleted. If present in bulk, they can significantly slow down the resolution of all network objects.

   

Creating Hostname Network Objects

You can create hostname objects: 

• In the Local Firewall ruleset.

• In the Forwarding Firewall ruleset.

• As global, range-specific, or cluster-specific firewall objects.

To create a hostname network object, select Hostname (DNS resolved) from the Type list in the Network Object window. Consider the following detailed configuration options:

Open

You can configure the following parameters: 

• Type – The type defines specific object characteristics. Network objects of type Hostname expect specification of an explicit DNS resolvable hostname in the Name field below.

• Name – In this field, insert the DNS resolvable name for which the object is to be created.

• Description – In this field, insert a significant object description.

• Resolve – The functionality of this button is purely informational. Click it to execute a DNS query for the hostname inserted in the Name field. The result of the query is displayed in the IP field in the Entry section. Note that the query is executed using the DNS server(s) known to the client running Barracuda Firewall Admin and NOT using the DNS server(s) known to the CloudGen Firewall running the firewall service.

• The Include and Exclude Entries sections may be used to restrict a network object and to force a condition to match explicitly or to exclude it from being part of it. For example, if a DNS hostname entry www.domain.com matches four DNS A-records pointing to the IP addresses 10.0.6.1, 10.0.8.1, 10.0.8.2, and 10.0.8.3, and you want connection requests to always point to addresses residing in the 10.0.8.0/24 network, but never be addressed to the IP address 10.0.8.3, the following values need to be configured in the corresponding fields: Section Included Entry: IP 10.0.8.0/24, section Excluded Entry: IP 10.0.8.3. The configuration stated above will be processed as follows when it is utilized in an access rule: Connection requests may be addressed to IP addresses living in the network 10.0.8.0/24, but they may not address the excluded IP address 10.0.8.3.

Using Hostname Network Objects 

You can use hostname objects as: 

• Source/Destination in rules within the Forwarding Firewall.

• Source/Destination in rules within the Local Firewall.

• Reference in the Entry list of generic network objects.

You cannot reference hostname objects in other network object types.

Monitoring Network Objects of Type Hostname 

DNS queries addressed to the DNS server configured in the box settings are triggered when a hostname network object is created. You can view these queries in the following places:

• In the Entries column in the network object list.

• In the Rule Object list when the hostname object configured in the rule is used.

• In the Source/Destination window querying the rule object list when the hostname object is currently used.

• In the Rule Tester.

• In the Dynamic Rules tab of the Firewall Monitoring Interface.

Site-specific Network Objects

Site-specific network objects can be used to share single access rulesets for branch offices with a template-based network layout. This type of object inherits its content from the IP address or IP network defined in the virtual server’s Server Properties of a branch office.