I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules:
sudo su groupadd dns-allowed iptables -A OUTPUT -p udp --dport 53 -m owner --gid-owner dns-allowed -j ACCEPT iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j REJECT
With the second, DNS queries are blocked successfully, but then i try to launch ping`` within
dns-allowed group, DNS queries still blocked:
sudo sg dns-allowed "ping google.com" ping: google.com: Name or service not known
I noticed that if i use
nslookup instead of ping with specifying DNS server 188.8.131.52 works when launched withing
dns-allowed group, but just as
ping fails, most of applications still cannot use DNS within it:
sudo sg dns-allowed "nslookup google.com 184.108.40.206" Server: 220.127.116.11 Address: 18.104.22.168#53 Non-authoritative answer: Name: google.com Address: ....
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 22.214.171.124 nameserver 126.96.36.199 nameserver 127.0.0.53
What is my mistake?