Hi All
I have a dns with a forwarder to my isp on the iptables box. I am having trouble on getting dns to work properly.
[snip]
I have tried the following with out any luck:
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
what rule do i need to add to make things more secure to get my dns working properly, thanks?
By the above rules, you are not allowing your clients to connect to your DNS server (you are only allowing DNS server to send queris outside). What you need is:
iptables -A INPUT -m state --state ESTABLISHED iptables -A INPUT -p icmp -m state --state RELATED
iptables -A INPUT -i int_if -p udp --sport 1024: --dport 53 \ -m state --state NEW -j ACCEPT iptables -A INPUT -i int_if -p tcp --sport 1024: --dport 53 \ -m state --state NEW -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED iptables -A OUTPUT -p icmp --m state --state RELATED
iptables -A OUTPUT -o ext_if -p udp --sport 1024: --dport 53 \ -m state --state NEW -j ACCEPT iptables -A OUTPUT -o ext_if -p tcp --sport 1024: --dport 53 \ -m state --state NEW -j ACCEPT
Replace int_if and ext_if with internal and external interface names (eth0, eth1, ppp0, or whatever else you have).
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
