5

I already have the following iptables rules applied in order to masq all of the wlan1 traffic through wlan0.

*filter
:INPUT ACCEPT [48:6144]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [47:6078]
-A INPUT -i wlan1 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan1 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan1 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan1 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -d 10.42.0.0/24 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.42.0.0/24 -i wlan1 -j ACCEPT
-A FORWARD -i wlan1 -o wlan1 -j ACCEPT
-A FORWARD -o wlan1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i wlan1 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Tue Mar  3 00:54:14 2015
# Generated by iptables-save v1.4.21 on Tue Mar  3 00:54:14 2015
*nat
:PREROUTING ACCEPT [1:66]
:INPUT ACCEPT [1:66]
:OUTPUT ACCEPT [10:651]
:POSTROUTING ACCEPT [10:651]
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
COMMIT

What i'm trying to achieve is redirecting all of the DNS queries form input interface wlan1 to some specific ip.

I already tired:

iptables -t nat -A PREROUTING -i wlan1 -p udp --dport 53 -j DNAT --to MYDNSIP:53

and

iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination MYDNSIP:53

But it doesn't seem to work. I would appreciate any help

-- Cheers

2 Answers 2

4

Allright, after a few tries I have finally achieved the goal. The key to the success were two rules below:

-A PREROUTING ! -s 10.42.0.1/32 ! -d 10.42.0.1/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.42.0.1:53
-A PREROUTING ! -s 10.42.0.1/32 ! -d 10.42.0.1/32 -p udp -m udp --dport 53 -j DNAT --to-destination 10.42.0.1:53

I hope that this will help someone

1
  • The thing is in your question you were only filtering udp packets for DNS but DNS uses both tcp and udp and your answer satisfies that..please select it as the correct answer so that this issue can be marked as solved..
    – heemayl
    Mar 3, 2015 at 20:54
0

Extra sample - Redirect DNS Queries to another server only for certain IP ranges:

-A PREROUTING ! -s 192.168.12.3/32 ! -d 192.168.12.3/32 -p tcp -m tcp -m iprange --src-range 10.0.0.10-10.0.0.240 --dport 53 -j DNAT --to-destination 192.168.12.3:53
-A PREROUTING ! -s 192.168.12.3/32 ! -d 192.168.12.3/32 -p udp -m udp -m iprange --src-range 10.0.0.10-10.0.0.240 --dport 53 -j DNAT --to-destination 192.168.12.3:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .