In previous Debian Jessie I could configure iptables to restrict DNS traffic to my own router (

Chain OUTBOUND (1 references)
target     prot opt source               destination         
ACCEPT     icmp --             
ACCEPT     tcp  --              state RELATED,ESTABLISHED
ACCEPT     udp  --              state RELATED,ESTABLISHED
ACCEPT     tcp  --              tcp dpt:80
ACCEPT     tcp  --              tcp dpt:443
ACCEPT     tcp  --            tcp dpt:53
ACCEPT     udp  --            udp dpt:53
LSO        all  --   

with Debian Stretch it no longer works

Debian Stretch forces to open the port 53 to everywhere or the browser and other software are not able to work. I'm worried this allow hidden dns-queries to third software.

I ask to know the reason why this simple iptables rule cannot work in Stretch.


root:# cat /etc/resolv.conf
# Generated by NetworkManager

root:# ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.424 ms
64 bytes from icmp_seq=2 ttl=64 time=0.298 ms
64 bytes from icmp_seq=3 ttl=64 time=0.494 ms

root:# tcpdump -nt -i eth0 udp port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
0 packets captured

root:# dig

no answer

from the router side:

root@router:~ # dig

; <<>> DiG 9.2.4 <<>>
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31716
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;                 IN      A

;; ANSWER SECTION:          0       IN      A

;; Query time: 1 msec
;; WHEN: Wed Oct 17 19:07:32 2018
;; MSG SIZE  rcvd: 47

root@router:~ # ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=0 ttl=64 time=0.257 ms
64 bytes from icmp_seq=1 ttl=64 time=0.222 ms
64 bytes from icmp_seq=2 ttl=64 time=0.331 ms
--- ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.222/0.270/0.331/0.045 ms, pipe 2
  • 1
    iptables(netfilter) is working, check your /etc/resolv.conf for the nameservers. – Ipor Sircer Oct 17 '18 at 16:53
  • 2
    by "it no longer works" you mean the iptables rules are successful in their goal, but that web browsers (and other software) attempt to do DNS lookups to other DNS servers? Or are DNS lookups failing to reach your DNS server? Or is your DNS server failing to return results? – Jeff Schaller Oct 17 '18 at 16:55
  • Can you also list the inbound rules? Are the connection tracking modules loaded? – V13 Oct 17 '18 at 22:05


ACCEPT     tcp  --            tcp dpt:53
ACCEPT     udp  --            udp dpt:53

means that you allow outgoing requests from to port 53. You'll need a similar rule with source port 53.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.