0

In previous Debian Jessie I could configure iptables to restrict DNS traffic to my own router (192.168.1.1):

Chain OUTBOUND (1 references)
target     prot opt source               destination         
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443
ACCEPT     tcp  --  192.168.1.1          0.0.0.0/0            tcp dpt:53
ACCEPT     udp  --  192.168.1.1          0.0.0.0/0            udp dpt:53
LSO        all  --  0.0.0.0/0            0.0.0.0/0 

with Debian Stretch it no longer works

Debian Stretch forces to open the port 53 to everywhere or the browser and other software are not able to work. I'm worried this allow hidden dns-queries to third software.

I ask to know the reason why this simple iptables rule cannot work in Stretch.


Edit:

root:# cat /etc/resolv.conf
# Generated by NetworkManager
search 192.168.1.1
nameserver 192.168.1.1


root:# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.424 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.298 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.494 ms


root:# tcpdump -nt -i eth0 udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured


root:# dig 192.168.1.1
^C

no answer

from the router side:

root@router:~ # dig 192.168.1.103

; <<>> DiG 9.2.4 <<>> 192.168.1.103
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31716
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;192.168.1.103.                 IN      A

;; ANSWER SECTION:
192.168.1.103.          0       IN      A       192.168.1.103

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct 17 19:07:32 2018
;; MSG SIZE  rcvd: 47


root@router:~ # ping 192.168.1.103
PING 192.168.1.103 (192.168.1.103) 56(84) bytes of data.
64 bytes from 192.168.1.103: icmp_seq=0 ttl=64 time=0.257 ms
64 bytes from 192.168.1.103: icmp_seq=1 ttl=64 time=0.222 ms
64 bytes from 192.168.1.103: icmp_seq=2 ttl=64 time=0.331 ms
^C
--- 192.168.1.103 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.222/0.270/0.331/0.045 ms, pipe 2
  • 1
    iptables(netfilter) is working, check your /etc/resolv.conf for the nameservers. – Ipor Sircer Oct 17 '18 at 16:53
  • 2
    by "it no longer works" you mean the iptables rules are successful in their goal, but that web browsers (and other software) attempt to do DNS lookups to other DNS servers? Or are DNS lookups failing to reach your DNS server? Or is your DNS server failing to return results? – Jeff Schaller Oct 17 '18 at 16:55
  • Can you also list the inbound rules? Are the connection tracking modules loaded? – V13 Oct 17 '18 at 22:05
0

This:

ACCEPT     tcp  --  192.168.1.1          0.0.0.0/0            tcp dpt:53
ACCEPT     udp  --  192.168.1.1          0.0.0.0/0            udp dpt:53

means that you allow outgoing requests from 192.168.1.1 to port 53. You'll need a similar rule with source port 53.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.