I have this nftables rule:
ip daddr { "0.nixos.pool.ntp.org", "1.nixos.pool.ntp.org", "2.nixos.pool.ntp.org", "3.nixos.pool.ntp.org" } udp dport ntp accept comment "Allow NTP traffic for system time"
The goal is to allow NTP traffic from a host that otherwise denies most traffic (default reject policy). The hostnames in the rule come from the system's default NTP configuration (so they're the same hostnames the NTP daemon is configured with).
It fails to load, however, because 0.nixos.pool.ntp.org
(and the others) have multiple addresses:
$ host 0.nixos.pool.ntp.org
0.nixos.pool.ntp.org has address 66.228.42.59
0.nixos.pool.ntp.org has address 216.229.4.66
0.nixos.pool.ntp.org has address 216.229.0.50
0.nixos.pool.ntp.org has address 69.10.161.7
So nftables complains and refuses to load the ruleset:
# nft -f ...-nftables-rules
...-nftables-rules:37:16-37: Error: Hostname resolves to multiple addresses
ip daddr { "0.nixos.pool.ntp.org", ... } udp dport ntp accept comment "..."
^^^^^^^^^^^^^^^^^^^^^^
These domain names are outside of my control. Thus, I can't stop them from resolving to multiple addresses. I also don't know when the address records associated with them might change.
How should I write my nftables ruleset to deal with this case?