I am trying to redirect all outbound DNS request(made from local) to a tunnel running on localhost listen for UDP on

iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to

Testing it with

nc -u -l -p 5353

nc -u 53

is fine, and udp session is working, but as I trying to test it with

nc -u 53

nc listening can receive the traffic, but reply it fail with

sent 2, rcvd 2 : Connection refused


iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to

can working correctly, and device running in the same wifi can receive and reply successfully.

I would like to thank you in advance for helping me.

Edit: DNS queries made with TCP are progressed separately, there is no need to consider it.

  • Is your named listening to requests on – Julie Pelletier Jul 16 '16 at 12:58
  • It is a proxy tunnel that will relay udp traffic, which can listen on other ports as well(I prefer to listen to a port >= 1024). – Xiaokang Wang Jul 16 '16 at 14:50
  • There is no proxy or tunnel in your question but I considered that was unimportant to answer it, but it is essential to clarify what interface and port your named is listening to. Failure to provide that will prevent you from getting the answer you need. – Julie Pelletier Jul 16 '16 at 15:02
  • add please netstat -an | grep 53 output and specify which daemon are you using to listen on port 5353 – Rui F Ribeiro Jul 16 '16 at 18:36
  • Is there any special design required for dealing with forwarded UDP traffic? It is an non-mainstream proxy, called v2ray, which can tunnel internet traffic through a encrypted tunnel. It's role and behavior is similar to DNSCrypt. I asked it to tunnel the traffic to remote. There is no special code in v2ray for dealing with forwarded traffic. – Xiaokang Wang Jul 16 '16 at 23:59

For redirecting DNS UDP based requests, if your DNS daemon/proxy is listening in port 5353/UDP, you have to do:

iptables -t nat -A PREROUTING -s -p udp -m udp --dport 53 -j DNAT --to-destination

The source has to be the internal netblock/network(s) used as we do not need loops (i.e. we still may need to do DNS requests to the outside).

If routing for a internal network in a multi homed machine, you can also apply the interface, not needing the source network.

iptables -i eth0 -t nat -A PREROUTING  -p udp -m udp --dport 53 -j DNAT --to-destination

You can also do it in port 53 as long as you blacklist the destination as in:

iptables -t nat -A PREROUTING  ! -d -p udp -m udp --dport 53 -j DNAT --to-destination

The OUTPUT queue may work in local tests, however for remote machines and the current config, it is advisable to use the PREROUTING queue.

  • Why was this answer downvoted? What's wrong with it, if anything? (I'm looking for a similar solution.) – MountainX Oct 9 '16 at 4:38
  • Because in the particular solution of routing through layer 7, eg a proxy, jt is indeed output; if routing via tcp/ip it is prerouting. This is a particular case of a very interesting configuration; ask yourself a question and direct me to it here. I may also had the full "problem" as a question answered by myself in my profile of my setup. – Rui F Ribeiro Oct 9 '16 at 6:29
  • (it was downvoted, but then corrected much later on) – Rui F Ribeiro May 15 '17 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.