An iptables script that uses an ipset to dynamically allow hosts that are defined with domain names at a firewall.

iptables-allow-by-dom.sh

!/usr/bin/env bash
IPTABLES=/sbin/iptables
IPSET=/sbin/ipset

TMPFILE1="/tmp/`uuidgen`.lookupres"

touch $TMPFILE1

$IPSET create allowedhosts hash:net
while read item; do
  #     echo $item
  LOOKUPRES=`host -4 $item|grep "has address"`
  echo $LOOKUPRES > $TMPFILE1

  while read resolvedhost; do
    ALLOWEDHOST=`echo  $resolvedhost|gawk '{print $4}'`
    echo "Adding host => $ALLOWEDHOST"
    $IPSET add allowedhosts $ALLOWEDHOST
  done < $TMPFILE1

done < /opt/etc/doms-to-allow.txt

$IPTABLES -L INPUT |grep "allowedhosts" >/dev/null
if [ "$?" -ne "0" ];then
  $IPTABLES -I INPUT -m set --match-set allowedhosts dst,src -j ACCEPT
fi

rm $TMPFILE1