iptables Hostname Rules Are DNS Snapshots
Understand why an iptables hostname exception can stop matching a site after DNS changes, and where a forward proxy's domain policy differs.
A hostname in an iptables command is resolved before the rule is submitted. The kernel rule matches the resulting addresses; it does not repeat DNS for each packet or inspect HTTP hostnames.
When an exception stops working, compare the numeric rule and counters with the address the client actually used. DNS changes, different resolver answers and extra resource hosts can leave that address outside the old rule. The reverse risk is an address shared with unrelated services: an IP exception can include those too.
Check ordering separately. A bypass after an already matching interception action may be too late, but moving it earlier does not maintain its address set.
| Required exception | Policy needed |
|---|---|
| Do not intercept connections to these network destinations | Packet-routing rules with a suitable address-maintenance strategy |
| Allow this client to request these names through Squid | Request-level destination-domain ACLs plus client and port restrictions |
A Squid allow keeps the request inside the proxy. A firewall bypass removes it from Squid's authorization path. Choose deliberately between them. With ordinary CONNECT, even a hostname-aware proxy decision does not expose the encrypted website path, so it cannot by itself become a page-path exception.