I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled.

The thing that is not clear to me is this: should I configure this at the router level or at the firewall level? If I should do this on the firewall, how would I go about doing this on an Ubuntu Server 12.04?

My home network has a few clients, an ESXi server and a home router. One of the VMs inside ESXi is the DNS server (running on Ubuntu Server 12.04) which is used to handle local DNS requests but is also configured as to forward requests for external IPs to Google's DNS servers.

  • 1
    It would help to provide your network topology. Is your DNS server behind a router? Is your internal network on a private subnet, or public? Is the router another server, off-the-shelf home router, or enterprise grade like Cisco? Is the DNS server supposed to be handling requests from outside the network, or internal only? What OS is running on the DNS server?
    – phemmer
    Apr 21, 2014 at 12:09
  • @Patrick you are right, I have updated the question Apr 21, 2014 at 13:41

1 Answer 1


This should be configured on whatever equipment you have between the DNS server and the outside world. AFAIK port forwarding is disabled by default on pretty much everything so you shouldn't worry too much about it. If you're using residential network gear, there should be port forwarding configuration options in the web interface. To check the port forwarding settings on Ubuntu use iptables:

$ sudo iptables -t nat -vnL

To ultimately check your network for the forwarded port use netcat to connect to the port via your external IP:

$ nc -vu [external ip] 53

You'll have to monitor the connections on the DNS server to watch for the netcat connection because netcat may incorrectly report that the connection was successful due to the stateless nature of UDP

  • 1
    Leave out the -u option to use the default TCP protocol instead of UDP. Aug 8, 2017 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.