Support ACL based on Domain/URL instead of IP

[btzq]

ISSUE TYPE

• Improvement Request

COMPONENT NAME

Improvement Request (Functionality)

CLOUDSTACK VERSION

4.19

CONFIGURATION

N/A

OS / ENVIRONMENT

N/A

SUMMARY

Note: This ticket is broken down as requested from the origianl post, #8841

Support ACL based on Domain/URL instead of IP

• As a company, sometimes i would like to block access to specific sites (eg. google drive), which is based on domain.
• But i am unable to do so because, ACL Rules are based on explicitly specifying the IP address.
• Specifying the IP address/range of the intended website will be tedious and non-practical.

STEPS TO REPRODUCE

N/A

N/A

EXPECTED RESULTS

To be able to manage ACL Rules more easily for enterprise use cases.

ACTUAL RESULTS

Unable to effectively block access to certain sites using URL/Domain

[DaanHoogland]

As ACLs are implemented using iptables there is not a trivial way to implement this. The VR will have to use ipset and dig/nslookup to create sets of ips from domain names and (re)apply those. It will be hard to make this relyable if users try to change those on the fly, or reorder them. There also needs to be a mechanism to update them automatically as DNS entruies for them may change out of bounds.

[btzq]

We got this idea on some enterprise firewalls like PFSense.

Is there no way to achieve a similar result?

[DaanHoogland]

Yes @btzq , there is, as described above, but the programming needs to be done on the VR. I am just saying it is not a trivial job. It is certainly possible.