iptables & dns resolution

This is a discussion on iptables & dns resolution within the Linux Security forums, part of the System Security and Security Related category; I am just beginning to learn how to use iptables as a firewall for one of my servers. In doing ...


Go Back   Usenet Forums > System Security and Security Related > Linux Security

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 12-02-2005
Jason Williard
 
Posts: n/a
Default iptables & dns resolution

I am just beginning to learn how to use iptables as a firewall for one
of my servers. In doing so, I have run into a bit of a roadblock that
I hope I can get some assistance with. The server that I am working
with acts as a DNS. At this point, clients are able to make DNS
requests to this server and get a proper response. However, the server
is unable to make DNS queries to other servers. Here is what I have in
my iptables:

iptables -A INPUT -i eth0 -p UDP --dport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p TCP --dport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p UDP --sport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP --sport domain -m state --state
NEW,ESTABLISHED -j ACCEPT

What am I missing here?

Reply With Quote
  #2 (permalink)  
Old 12-02-2005
Jason Williard
 
Posts: n/a
Default Re: iptables & dns resolution

Okay, I guess I just needed to put a little more thought into this...
or perhaps have another cup of coffee.

The solution, or my solution, was to add the following:
iptables -A INPUT -i eth0 -p UDP --sport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p TCP --sport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p UDP --dport domain -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p TCP --dport domain -m state --state
NEW,ESTABLISHED -j ACCEPT

Reply With Quote
  #3 (permalink)  
Old 12-02-2005
Wuvbear
 
Posts: n/a
Default Re: iptables & dns resolution

for i in tcp udp; do
iptables -A INPUT -i eth0 -p $i --sport domain -m state --state NEW -j
ACCEPT
iptables -A INPUT -i eth0 -p $i --dport doman -m state --state NEW -j
ACCEPT
iptables -A OUTPUT -o eth0 -p $i --sport domain -m state --state NEW -j
ACCEPT
iptables -A OUTPUT -o eth0 -p $i --dport doman -m state --state NEW -j
ACCEPT
done
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED.ESTABLISHED -j ACCEPT

because your server will have to anwser TO dns requests. And do DNS
requests to other servers as well.

Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 07:48 AM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0