0

I'm trying to apply a port forward rule to forward UDP traffic from my AP on port 53 to a custom DNS server listening to 9053. I tried various calls. None of them worked. I've tried this in Kali. Below you can find the outputs before I've applied any forwarding rules of 

iptables -S; iptables -S -t nat

********* NAT *************
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      *       10.42.0.0/24        !10.42.0.0/24        
********* FILTER *************
Chain INPUT (policy ACCEPT 33 packets, 7260 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 ACCEPT     udp  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      wlan0   0.0.0.0/0            10.42.0.0/24         state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  wlan0  *       10.42.0.0/24         0.0.0.0/0           
    0     0 ACCEPT     all  --  wlan0  wlan0   0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      wlan0   0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  wlan0  *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

These are the rules that I've tried to apply and non of them worked:

sudo iptables -t nat -A PREROUTING -p udp -i wlan0 --dport 53 -j REDIRECT --to-ports 9053

BTW it should not be persistent since the 9053 is randomised.

Few clarifications: 1. ip_forward flags are set to 1

  1. Wireshark returns ICMP error response with port unreachable and destination unreachable

  2. I used the Share Connection functionality from the wifi settings – IdanE

  3. I have set a DNS service which runs locally on Linux listening to 9053. The service runs as expected (used nslookup to communicate with it directly.

  4. Other TCP forwarding rules to other services work find. It something with UDP redirect.

||improve this question
  • What does tshark (or wireshark) show for ports 53 and 9053? – roaima Mar 13 '19 at 10:10
  • Off the top of my head I can't remember if this requires /proc/sys/net/ipv4/ip_forward set to 1 but it's worth checking. – Philip Couling Mar 13 '19 at 10:14
  • 1
    There are wireless interfaces and a tor port in the question. We also do not know if this is hostapd or a wifi AP and it is not clear who is the doing the dns interception Please make an effort to expose the situation properly. – Rui F Ribeiro Mar 13 '19 at 10:37
  • 1. ip_forward flags are set to 1 – IdanE Mar 13 '19 at 12:25
  • 2. Wireshark returns ICMP error response with port unreachable and destination unreachable – IdanE Mar 13 '19 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.