ufw blocks DNS response

Question

i've got an ubuntu server (Ubuntu 22.04 LTS) running with svn, duplicati, rdp-forwarding and ssh-access. My problem is that i cant resolve hostnames within our network an beyond. sudo apt update is not working with enabled ufw. When i disable ufw, updates can be downloaded. I allowed port 53 in ufw (udp an tcp):

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       10.7.3.0/24
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
4343/udp                   ALLOW       10.7.3.0/24
8200/tcp                   ALLOW       10.7.3.0/24
3389/tcp                   ALLOW       Anywhere
3389/udp                   ALLOW       Anywhere
53/tcp                     ALLOW       193.175.120.18
53/udp                     ALLOW       193.175.120.18
53/udp                     ALLOW       193.175.120.17
53/tcp                     ALLOW       193.175.120.17

10.7.3.0/24 22             ALLOW OUT   Anywhere
10.7.3.0/24 3389           ALLOW OUT   Anywhere
53/tcp                     ALLOW OUT   Anywhere
53/udp                     ALLOW OUT   Anywhere

Via IP-tables i implemented the port forwarding:

*nat
:PREROUTING ACCEPT [0:0]
#forward rdp to cbs-rechner
-A PREROUTING -i eno1 -p tcp --dport 3389 -j DNAT --to-destination 10.7.3.23:3389
-A PREROUTING -i eno1 -p udp --dport 3389 -j DNAT --to-destination 10.7.3.23:3389
#setup routing
-A FORWARD -p tcp --dport 3389 -j ACCEPT
-A FORWARD -p udp --dport 3389 -j ACCEPT

COMMIT

This is what i put before *filter-section

The output of time dig 193.175.120.17 is

;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> 193.175.120.17
;; global options: +cmd
;; no servers could be reached


real    0m15,032s
user    0m0,006s
sys     0m0,007s

When i execute sudo apt update, i've got entries in /var/log/syslog:

Dec 12 09:24:26 rt-mw-svn-server kernel: [ 2921.895959] [UFW BLOCK] IN=eno1 OUT= MAC=98:90:96:c0:09:da:00:10:f3:92:d7:f7:08:00 SRC=193.175.120.17 DST=10.15.0.12 LEN=292 TOS=0x00 PREC=0x00 TTL=63 ID=12340 PROTO=UDP SPT=53 DPT=42188 LEN=272
Dec 12 09:24:47 rt-mw-svn-server kernel: [ 2941.916869] [UFW BLOCK] IN=eno1 OUT= MAC=98:90:96:c0:09:da:00:10:f3:92:d7:f7:08:00 SRC=193.175.120.17 DST=10.15.0.12 LEN=152 TOS=0x00 PREC=0x00 TTL=63 ID=15731 PROTO=UDP SPT=53 DPT=40610 LEN=132

The interesting thing is, that the destination port (DPT) in the log is different in each entry. So of course allowing port 53 is useless. But how can I allow incoming packets from my DNS? I already checked the network. There is definitely a response from the DNS. Thank you in advance

New discovery: When enabling the ufw with sudo ufw enable, ther is an error:

sudo ufw enable Command may disrupt existing ssh connections. Proceed with operation > (y|n)? y ERROR: problem running ufw-init iptables-restore: line 21 failed

Problem running '/etc/ufw/before.rules'

line 21 is the COMMIT line of IP-tables. And there is the hint for the solution.

Answer 1

When I comment out the two FORWARDING lines in the IP-tables /etc/ufw/before.rules the error disappears. The forwarding is still active through the PREROUTING lines. The correct setting in IP-tables is the following:

:PREROUTING ACCEPT [0:0]
#forward rdp to cbs-rechner
-A PREROUTING -i eno1 -p tcp --dport 3389 -j DNAT --to-destination 10.7.3.23:3389
-A PREROUTING -i eno1 -p udp --dport 3389 -j DNAT --to-destination 10.7.3.23:3389

COMMIT ```
the ufw status looks the same as in my question.