| A: | Yes, you can; however, when the rules are initially loaded, netfilter will perform a lookup on those names and use the IP address returned at that time. So any updates against the hostname made after the rules have been loaded will have no effect. The hard way to update this would be to write something using the iptables -R flag (replace). The -R flag, however, suffers from issues when the source and/or destination names resolved to multiple addresses. The low-tech approach to dealing with this problem is just to reload your rules. |