[Firehol-support] Dynamic hosts (eg no-ip) and fail2ban

[Jason Harris]

First off, I wanted to say thanks for firehol! The documentation and 
getting started was pretty easy! I really like the "clean" feel to it!

So saying that my current issue I am facing is that I would like to 
white-list a dynamic host(s), eg if my dynamically changing host is 
jasonLaptop.No-ip.com I would like this white listed with something like:

permitted_sites="jasonLaptop.No-ip.com first.server.ourdomain.com 
second.server.ourdomain.com"

interface eth0 world

     policy reject
     protection strong 30/sec 40 src not "${permitted_sites}"

     server http accept src "${permitted_sites}"
     server https accept src "${permitted_sites}"
     server ntp accept src "${permitted_sites}"
     server ssh accept

So this works on the surface.

Question 1: If jasonLaptop.No-ip.com changes then I would like basically 
"firehol restart" to be called. Is there a nice way of doing that in 
firehol? Anybody written some scripts before I re-invent the wheel here?

Question 2: Currently for testing I am taking the dumb approach here and 
just croning a "firehol restart" periodically several times an hour. Is 
this ok from a security point of view. (I didn't quite understand the 
bit in the documentation where it talks about the security of the 
firewall during the boot up period of firehol. I saw it somewhere in the 
documentation but I am having some trouble finding that section again.)

Question 3: Instead of croning a "firehol restart" periodically, I could 
get slightly more sophisticated with this and just do a dig say every 
minute on all the permitted sites and if the results of these lookups 
change then restart firehol... (Importantly if I switch off 
jasonLaptop.No-ip.com then even if I am croning "firehol restart" 
preiodically then the rules won't get updated since the lookup on 
jasonLaptop.No-ip.com will fail hence the new configuration will not 
"take".) So it seems likely that I will need a smarter script here. I 
though these might be common questions or there might be another way to 
handle this so I am asking here first... Is there a better way to do 
this than rolling my own script here?

Question 4: If we are restarting firehol on a semi-regular basis will 
this cause any problems with fail2ban?

Thanks!
    Jason