Hello i have a very hard time on getting along with iptables and bind9 as my internal network dns server. It's configured to forward my queries to google's dns (8.8.8.8).
The main problem is i can't configure iptables to allow to speak with my dns. My main rule is to drop all INPUT and OUTPUT connections and allow only those i require for some services and bind9.
Here is my iptables now
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:1155
ACCEPT tcp -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spt:domain
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:1155 state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT all -- anywhere anywhere
I have tried to use what this user says but with no luck.
Also i have tried many combinations allowing port 53 for udp and tcp like this
sudo iptables -A INPUT -s 192.168.0.0/24 -m state --state NEW -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -s 192.168.0.0/24 -m state --state NEW -p udp --dport 53 -j ACCEPT
Also here is what i get from sudo netstat -anp | grep -e tcp -e udp
tcp 0 0 0.0.0.0:1155 0.0.0.0:* LISTEN 969/sshd
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1179/apache2
tcp 0 0 192.168.0.22:53 0.0.0.0:* LISTEN 1087/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1087/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 1087/named
tcp 0 0 192.168.0.22:1155 192.168.0.20:50016 ESTABLISHED 1263/sshd: giorgos
tcp6 0 0 :::1155 :::* LISTEN 969/sshd
tcp6 0 0 :::53 :::* LISTEN 1087/named
tcp6 0 0 ::1:953 :::* LISTEN 1087/named
udp 0 0 192.168.0.22:53 0.0.0.0:* 1087/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 1087/named
udp 0 0 0.0.0.0:68 0.0.0.0:* 943/dhclient3
udp6 0 0 :::53 :::* 1087/named