1

I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules:

sudo su
groupadd dns-allowed
iptables -A OUTPUT -p udp --dport 53 -m owner --gid-owner dns-allowed -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j REJECT

With the second, DNS queries are blocked successfully, but then i try to launch ping`` within dns-allowed group, DNS queries still blocked:

sudo sg dns-allowed "ping google.com"
ping: google.com: Name or service not known

I noticed that if i use nslookup instead of ping with specifying DNS server 8.8.8.8 works when launched withing dns-allowed group, but just as ping fails, most of applications still cannot use DNS within it:

sudo sg dns-allowed "nslookup google.com 8.8.8.8"
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   google.com
Address: ....

resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver 127.0.0.53

What is my mistake?

  • What are the contents of /etc/resolv.conf? It might be that you are running a local nameserver and that all the external requests are coming from a daemon. – icarus Mar 2 '17 at 2:34
  • @icarus surprisely it points to the nameserver 127.0.1.1 however my networkmanager connection has DNS server 8.8.8.8 configured. I am lost with this. It's ubuntu. – Martin Mar 2 '17 at 2:44
  • @icarus I removed dnsmasq and it now points to google DNS, however, problem is not gone with ping, curl, only nslookup is working. – Martin Mar 2 '17 at 2:49
  • So you probably are running systemd-resolve (the 127.0.0.53 server). For example if you run ping google.com then ping will use the C library routines like gethostbyname to get the address. This will typically use /etc/nsswitch.conf to guide it into loading additional shared libraries which do the lookup. You should probably run nslookup in its interactive mode and use the server command to know exactly where you are sending queries, or maybe use dig instead. – icarus Mar 2 '17 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.