I'm trying to apply a port forward rule to forward UDP traffic from my AP on port 53 to a custom DNS server listening to 9053. I tried various calls. None of them worked. I've tried this in Kali. Below you can find the outputs before I've applied any forwarding rules of
iptables -S; iptables -S -t nat
********* NAT *************
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * * 10.42.0.0/24 !10.42.0.0/24
********* FILTER *************
Chain INPUT (policy ACCEPT 33 packets, 7260 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- wlan0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
0 0 ACCEPT tcp -- wlan0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
0 0 ACCEPT udp -- wlan0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- wlan0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * wlan0 0.0.0.0/0 10.42.0.0/24 state RELATED,ESTABLISHED
0 0 ACCEPT all -- wlan0 * 10.42.0.0/24 0.0.0.0/0
0 0 ACCEPT all -- wlan0 wlan0 0.0.0.0/0 0.0.0.0/0
0 0 REJECT all -- * wlan0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- wlan0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
These are the rules that I've tried to apply and non of them worked:
sudo iptables -t nat -A PREROUTING -p udp -i wlan0 --dport 53 -j REDIRECT --to-ports 9053
BTW it should not be persistent since the 9053 is randomised.
Few clarifications: 1. ip_forward flags are set to 1
Wireshark returns ICMP error response with port unreachable and destination unreachable
I used the Share Connection functionality from the wifi settings – IdanE
I have set a DNS service which runs locally on Linux listening to 9053. The service runs as expected (used nslookup to communicate with it directly.
Other TCP forwarding rules to other services work find. It something with UDP redirect.
tshark
(orwireshark
) show for ports 53 and 9053? – roaima Mar 13 '19 at 10:10/proc/sys/net/ipv4/ip_forward
set to1
but it's worth checking. – Philip Couling Mar 13 '19 at 10:14