0

I'm having a ridiculous problem.

I want to allow only 1 user internet access. Set up IPTABLES and I can ping with the allowed user, but all DNS traffic is blocked.

However adding root user "fixes" the problem. WTH is going on?!

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    LOG        all  --  anywhere             anywhere             LOG level debug prefix "iptables denied output: "
2    ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
3    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
4    ACCEPT     all  --  anywhere             anywhere             owner UID match test
5    DROP       all  --  anywhere             anywhere            
test@test-VirtualBox:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=5.05 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=5.25 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 5.059/5.158/5.258/0.122 ms
test@test-VirtualBox:~$ ping stackexchange.com
ping: unknown host stackexchange.com
test@test-VirtualBox:~$ 

Logs

Feb  7 14:38:14 test-VirtualBox kernel: [14848.267387] iptables denied output: IN= OUT=lo SRC=127.0.0.1 DST=127.0.1.1 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=2588 DF PROTO=UDP SPT=33317 DPT=53 LEN=30 
Feb  7 14:38:14 test-VirtualBox kernel: [14848.267535] iptables denied output: IN= OUT=enp0s3 SRC=10.0.0.119 DST=8.8.8.8 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=39417 DF PROTO=UDP SPT=36975 DPT=53 LEN=30 
Feb  7 14:38:14 test-VirtualBox kernel: [14848.314265] iptables denied output: IN= OUT=lo SRC=127.0.1.1 DST=127.0.0.1 LEN=120 TOS=0x00 PREC=0x00 TTL=64 ID=56633 DF PROTO=UDP SPT=53 DPT=33317 LEN=100 
Feb  7 14:38:19 test-VirtualBox kernel: [14853.273968] iptables denied output: IN= OUT=lo SRC=127.0.0.1 DST=127.0.1.1 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=3453 DF PROTO=UDP SPT=33317 DPT=53 LEN=30 
Feb  7 14:38:19 test-VirtualBox kernel: [14853.274099] iptables denied output: IN= OUT=enp0s3 SRC=10.0.0.119 DST=8.8.8.8 LEN=50 TOS=0x00 PREC=0x00 TTL=64 ID=40515 DF PROTO=UDP SPT=36975 DPT=53 LEN=30 
Feb  7 14:38:19 test-VirtualBox kernel: [14853.280184] iptables denied output: IN= OUT=lo SRC=127.0.1.1 DST=127.0.0.1 LEN=120 TOS=0x00 PREC=0x00 TTL=64 ID=57565 DF PROTO=UDP SPT=53 DPT=33317 LEN=100 
  • Have you verified dns resolution with something other than ping, e.g. curl? Depending on distro, ping might be setuid root or have equivalent cap entries (cap_net_admin,cap_net_raw+p) – Ulrich Schwarz Feb 7 '18 at 6:44
  • Dig, curl, opening a browser, the actual software I want to allow access... nothing can resolve DNS unless I allow the root user in iptables. If I run dig stackexchange.com from the test user its says it cannot resolve. If I run sudo dig stackexchange.com I get a permission denied. When I add the root user, DNS works for both root and the test user. – sjaak Feb 7 '18 at 8:28
  • Please add non-comment lines from /etc/resolv.conf to your question. – roaima Feb 7 '18 at 9:45
0

Probably you have a resolver installed. Such resolver helps to cache DNS queries for all users, and it is run by root (or 'nobody').

Check which resolver are you using (e.g. on modern distribution, the resolver included in systemd, previously a common resolver was lwresd (from bind).

  • Thanks, this put me in the right direction. systemd was indeed doing the resolving. After disabling the resolver and letting my router handle all dns traffic, the iptable rules are working as intended. – sjaak Feb 9 '18 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.