Page MenuHomeVyOS Platform

Hostname Support in NAT and Firewall Rules
Needs testing, NormalPublicFEATURE REQUEST


One thing that keeps me from using VyOS in some environments is the lack of support for host names in firewall groups and rules and nat rules. It would be great if hostnames could be used for rules as not everyone has static IPs, but setting up dynamic DNS is easy. I can tell you this works great in pfSense, OpenSense, and Juniper SRX devices.


Difficulty level
Unknown (require assessment)
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Event Timeline

syncer triaged this task as Low priority.Nov 7 2018, 4:58 PM

I agree this is becoming increasingly necessary as vendors turn to AWS for hosting services and IP addressing becomes less static for services.

Supporting a hostname typically results in a DNS lookup at the time of rule creation and then no change until the rule is reloaded. As a work-around to this some distributions reload hostname-based rules every 5 min while others do so daily.

This still has some caveats however: In one example a DNS record which is more dynamic has makes use of a low TTL may change more frequently than the update interval. In another a lookup which returns multiple A records presumably would be expected to generate multiple firewall rules while many implementations may only select the first response. There are other assumptions made on behavior by the user (how are CNAMEs handled?).

To implement this in VyOS the right way would be non-trivial and require a bit of development. I would suggest the use of VyOS-generated address-group (ipset) which is populated and updated by a background process which keeps track of TTL values.

Syntax-wise this could be placed under the umbrella of a new firewall group type e.g. "name-group". Members of a name-group would be a FQDN. A daemon (or routine cron) handle resolving the FQDN(s) into the IP(s) associated while also tracking the TTL. On update new entries would be added but old entries would not be removed until their TTL expired.

Configuration would look something like:

set firewall group name-group NAME-EXAMPLE name ''
set firewall group name-group NAME-EXAMPLE name ''

set firewall name LAN-OUT rule 100 destination group name-group NAME-EXAMPLE

This would allow name-based functionality to be implemented in the way users often assume is the case despite known caveats and limitations typically encountered in other implementations.

Other enhancements could include DNSSEC support where one a key is learned it is added to the group configuration and enforced unless overridden.

A mock-up of this has been on my to-do list but unfortunately I have not had the time. Is anyone familiar with an existing project which might already do this or something similar?

syncer renamed this task from Hostname Support to Hostname Support in NAT and Firewall Rules.Mar 1 2020, 9:56 PM
syncer set Is it a breaking change? to Unspecified (possibly destroys the router).
erkin set Issue type to Feature (new functionality).Sep 1 2021, 10:50 AM
syncer changed the task status from Open to In progress.Dec 25 2021, 11:35 PM
syncer raised the priority of this task from Low to High.
syncer moved this task from Need Triage to Backlog on the VyOS 1.4 Sagitta board.
syncer added a subscriber: syncer.

this requires a helper that will be responsible for the DNS resolution and update of the corresponding rules
each DNS resolution will refresh IPs every 15 seconds or in smart mode will rely on DNS TTL for records and will do a lookup on TTL expire (and update firewall if required)


set firewall group domain-group DOMAINS address ''
set firewall group domain-group DOMAINS address ''
set firewall name FOO default-action 'accept'
set firewall name FOO rule 10 action 'drop'
set firewall name FOO rule 10 source group domain-group 'DOMAINS'
set interfaces ethernet eth0 firewall local name 'FOO'
Viacheslav changed the task status from In progress to Needs testing.Jun 9 2022, 4:58 PM
Viacheslav lowered the priority of this task from High to Normal.Jun 9 2022, 5:01 PM
  1. Some domains can't be added, for example
[email protected]# set firewall group domain-group DOMAINS address

  Invalid value
  Value validation failed
  Set failed

[email protected]# 

[email protected]# set firewall group domain-group DOMAINS address
[email protected]#
  1. Set Domain group without address Fails
[email protected]# set firewall group domain-group DOMAIN
[email protected]# commit
[ firewall ]
VyOS had an issue completing a command.

Traceback (most recent call last):
  File "/usr/libexec/vyos/conf_mode/", line 458, in <module>
  File "/usr/libexec/vyos/conf_mode/", line 426, in apply
    for address in group_config['address']:
KeyError: 'address'

[[firewall]] failed
Commit failed
[email protected]#


Adds firewall node rule N source/destination fqdn for single domains per rule and refactors resolver daemon.

How far are we in the testing of this important feature ?

How far are we in the testing of this important feature ?

Try it with groups

set firewall group domain-group domains address
set nat source rule 100 destination group domain-group domains