0

I currently have a Linux box as my gateway running Debian 10 Buster.

This machine runs an unbound DNS server that I use to re-route DNS requests to different servers depending on what host is being looked up mainly for things like Netflix/Hulu, etc. I have persistent iptable rules in place to force all port 53 traffic to the gateway box and it works quite well.

The iptable rules are here:

    *filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sun May 24 09:13:42 2020

*nat
-A POSTROUTING -o wan0.10 -j MASQUERADE
# -A POSTROUTING -o internet -j MASQUERADE
-i lan0 -A PREROUTING  -p udp -m udp --dport 53 -j DNAT --to-destination 10.1.1.1:53
-i lan0 -A PREROUTING  -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.1.1.1:53
-i lan1 -A PREROUTING  -p udp -m udp --dport 53 -j DNAT --to-destination 10.1.1.1:53
-i lan1 -A PREROUTING  -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.1.1.1:53
-A PREROUTING -i wan0.10 -p tcp --dport 31346 -j DNAT --to 10.1.1.120:31346
COMMIT

*filter
-A INPUT -i lo -j ACCEPT

# SSH always working
-A INPUT -i lan0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i lan1 -p tcp -m tcp --dport 22 -j ACCEPT

# allow traffic
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i wan0.10 -j DROP

COMMIT

My problem is I have one server on the LAN that I would like to bypass these rules and have access to pure DNS.

How would I go about overriding these rules for a single host on the network and also are rules in a first come first serve basis e.g. later rules override previous ones?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.