1

I have a server with IP 10.0.0.1/24 and I have a firewall which is the default gateway with IP 10.0.0.2/24. I need to set permissions on the firewall to allow only the server to access the dns service. I have to use iptables.

2

If your firewall FORWARD chain is doing DROP by default, this should be enough:

iptables -A FORWARD -s 10.0.0.1 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 10.0.0.1 -p udp --dport 53 -j ACCEPT

(DNS uses both port 53 UDP and TCP)

If you also want to specify a DNS server 10.1.1.1 for instance:

iptables -A FORWARD -s 10.0.0.1 -d 10.1.1.1 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 10.0.0.1 -d 10.1.1.1 -p udp --dport 53 -j ACCEPT

You may also configure the DNS server to only accept requests from the IP addresses/network which it is required to give answers in it's configuration files.

  • @MarvicGrima default policy on iptables is ACCEPT. You should also add these rules to bottom to drop rest. iptables -A FORWARD -p udp --dport 53 -j DROP ; iptables -A FORWARD -p tcp --dport 53 -j DROP – ibrahim Jan 10 '18 at 12:49
1

(Assuming bind DNS is being used) - Why not just have the DNS service/daemon only listen on 127.0.0.1. Just add this to the options for the bind daemon:

listen-on { 127.0.0.1; };

Then have the server use the DNS server at 127.0.0.1. No firewall rules needed! :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.