9

I am configuring the security in my server. For easier the manage at the firewall, I installed the UFW. I did some settings in the UFW and I allowed some ports. Therefor when I enabled it the DNS services not responding.

I tried running the command DIG www.domain.com.br to test the DNS but it did not succeed. This command run without problems when the UFW is disabled. I already allowed the 53 port (TCP and UDP) but the DNS does not work.

My UFW settings:

Status: active
Logging: on (low)
Default: deny (incoming), deny (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
21/tcp                     ALLOW IN    Anywhere
16/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
80                         ALLOW IN    Anywhere
53                         ALLOW IN    Anywhere
465                        ALLOW IN    Anywhere
25/tcp                     ALLOW IN    Anywhere
22                         ALLOW IN    Anywhere
21/tcp (v6)                ALLOW IN    Anywhere (v6)
16/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)
80 (v6)                    ALLOW IN    Anywhere (v6)
53 (v6)                    ALLOW IN    Anywhere (v6)
465 (v6)                   ALLOW IN    Anywhere (v6)
25/tcp (v6)                ALLOW IN    Anywhere (v6)
22 (v6)                    ALLOW IN    Anywhere (v6)
11

The full correct syntax should be

sudo ufw allow out to any port 53
9

I solved this problem. I allowed the outgoing for port 53 that is DNS service port. Thanks.

sudo ufw allow out 53
3

Firstly ufw allow dns allows ingoing DNS requests, which is not what you want.

Secondly you can follow all commands mentioned in other answers (most easily ufw allow out 53), but order matters. So if you have a deny statement, which would also deny DNS requests when used solely, put it last!

So first allow port 53 to your DNS server and later potentially disallow/deny some requests.

2

I've been working on some firewall rules myself for another project and wasn't able to get @diegoklapper's solution to work.

Even my own attempts to replicate sudo ufw allow dns more explicitly (i.e. specific interface) failed:

sudo ufw allow in on eth0 from any to any port 53 proto tcp

Until I realized what I was doing wrong (note protocol):

sudo ufw allow in on eth0 from any to any port 53 proto udp

Note: This more specifically applies to dnsmasq in the case where you're handling or forwarding DNS requests and where outbound requests are already allowed by default.

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip

To                         Action      From
--                         ------      ----
53/udp on eth0             ALLOW IN    Anywhere

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.