Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Hello i have a very hard time on getting along with iptables and bind9 as my internal network dns server. It's configured to forward my queries to google's dns (8.8.8.8).

The main problem is i can't configure iptables to allow to speak with my dns. My main rule is to drop all INPUT and OUTPUT connections and allow only those i require for some services and bind9.

Here is my iptables now

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:1155
ACCEPT     tcp  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere             udp spt:domain
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:1155 state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     all  --  anywhere             anywhere            

I have tried to use what this user says but with no luck.

Also i have tried many combinations allowing port 53 for udp and tcp like this

sudo iptables -A INPUT -s 192.168.0.0/24 -m state --state NEW -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -s 192.168.0.0/24 -m state --state NEW -p udp --dport 53 -j ACCEPT

Also here is what i get from sudo netstat -anp | grep -e tcp -e udp

tcp        0      0 0.0.0.0:1155            0.0.0.0:*               LISTEN      969/sshd        
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1179/apache2    
tcp        0      0 192.168.0.22:53         0.0.0.0:*               LISTEN      1087/named      
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      1087/named      
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      1087/named      
tcp        0      0 192.168.0.22:1155       192.168.0.20:50016      ESTABLISHED 1263/sshd: giorgos 
tcp6       0      0 :::1155                 :::*                    LISTEN      969/sshd        
tcp6       0      0 :::53                   :::*                    LISTEN      1087/named      
tcp6       0      0 ::1:953                 :::*                    LISTEN      1087/named      
udp        0      0 192.168.0.22:53         0.0.0.0:*                           1087/named      
udp        0      0 127.0.0.1:53            0.0.0.0:*                           1087/named      
udp        0      0 0.0.0.0:68              0.0.0.0:*                           943/dhclient3   
udp6       0      0 :::53                   :::*                                1087/named  
share|improve this question
    
You redirect all dns req to google dns? –  2707974 Mar 27 at 15:34
    
yeap to 8.8.8.8 –  John Bassos Mar 29 at 13:54
    
You server have only one ethernet card? –  2707974 Mar 31 at 7:15

1 Answer 1

Ok, iptables rule for this can be something like this

this will accept dns req

sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -m state --state NEW -p tcp --dport 53 -j ACCEPT
sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -m state --state NEW -p udp --dport 53 -j ACCEPT

This will create chain to catch dns req

sudo iptables -t nat -N CATCH_DNS
sudo iptables -t nat -A CATCH_DNS -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
sudo iptables -t nat -A CATCH_DNS -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53

Then you can apply rule on INPUT

sudo iptables -t nat -A INPUT -s 192.168.0.0/24 -j CATCH_DNS

I think this will work :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.