0

Hello i have a very hard time on getting along with iptables and bind9 as my internal network dns server. It's configured to forward my queries to google's dns (8.8.8.8).

The main problem is i can't configure iptables to allow to speak with my dns. My main rule is to drop all INPUT and OUTPUT connections and allow only those i require for some services and bind9.

Here is my iptables now

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:1155
ACCEPT     tcp  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere             udp spt:domain
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:1155 state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     all  --  anywhere             anywhere            

I have tried to use what this user says but with no luck.

Also i have tried many combinations allowing port 53 for udp and tcp like this

sudo iptables -A INPUT -s 192.168.0.0/24 -m state --state NEW -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -s 192.168.0.0/24 -m state --state NEW -p udp --dport 53 -j ACCEPT

Also here is what i get from sudo netstat -anp | grep -e tcp -e udp

tcp        0      0 0.0.0.0:1155            0.0.0.0:*               LISTEN      969/sshd        
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1179/apache2    
tcp        0      0 192.168.0.22:53         0.0.0.0:*               LISTEN      1087/named      
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      1087/named      
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1087/named      
tcp        0      0 192.168.0.22:1155       192.168.0.20:50016      ESTABLISHED 1263/sshd: giorgos 
tcp6       0      0 :::1155                 :::*                    LISTEN      969/sshd        
tcp6       0      0 :::53                   :::*                    LISTEN      1087/named      
tcp6       0      0 ::1:953                 :::*                    LISTEN      1087/named      
udp        0      0 192.168.0.22:53         0.0.0.0:*                           1087/named      
udp        0      0 127.0.0.1:53            0.0.0.0:*                           1087/named      
udp        0      0 0.0.0.0:68              0.0.0.0:*                           943/dhclient3   
udp6       0      0 :::53                   :::*                                1087/named  
3
  • You redirect all dns req to google dns?
    – 2707974
    Mar 27, 2014 at 15:34
  • yeap to 8.8.8.8 Mar 29, 2014 at 13:54
  • You server have only one ethernet card?
    – 2707974
    Mar 31, 2014 at 7:15

1 Answer 1

0

Ok, iptables rule for this can be something like this

this will accept dns req

sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -m state --state NEW -p tcp --dport 53 -j ACCEPT
sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -m state --state NEW -p udp --dport 53 -j ACCEPT

This will create chain to catch dns req

sudo iptables -t nat -N CATCH_DNS
sudo iptables -t nat -A CATCH_DNS -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
sudo iptables -t nat -A CATCH_DNS -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53

Then you can apply rule on INPUT

sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -j CATCH_DNS

I think this will work :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .