DNS only works when I have a port 53 UDP outbound rule AND INBOUND rule

geekygeek

10/6/23, 7:01 PM

I'm locking down both inbound and outbound ports with

iptables -P INPUT DROP
iptables -P OUTPUT DROP

Then, I allow certain traffic to certain servers

SSH from my network to the server (inbound)
HTTP requests on port 8080 from the server to another server (outbound)

iptables -A INPUT -p tcp -s <my_ip> --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -d <server_ip> --dport 8080 -j ACCEPT

I noticed some problems with the above rules and doing HTTP requests, so I added

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

For DNS, I then added :

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

However, nslookup would not work:

nslookup google.com

What ended up working is also allowing port 53 inbound traffic:

iptables -A INPUT -p udp --dport 53 -j ACCEPT

In total, these are my commands:

1. iptables -A INPUT -p tcp -s <my_ip> --dport 22 -j ACCEPT
2. iptables -A OUTPUT -p tcp -d <my_server> --dport 8080 -j ACCEPT
3. iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
4. iptables -A INPUT -p udp --dport 53 -j ACCEPT
3. iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
4. iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
5. iptables -P INPUT DROP
6. iptables -P OUTPUT DROP

My question is: I wanted to lock down the server as much as possible. I didn't think I'd need to open UDP inbound. I know UDP is stateless etc. but I've generally never needed to open anything inbound to make DNS work, whether on firewalls or my Windows machines.

Am I doing something wrong that I need port 53 inbound?

355

0 + 3

iptables

firewall

networking

dns

Doug Smythies

10/6/23, 11:18 PM

Agreed, it doesn't make sense that you would need `iptables -A INPUT -p udp --dport 53 -j ACCEPT`. When we also consider [your question from yesterday](https://askubuntu.com/questions/1433946/dnating-dns-requests-that-arent-going-to-a-particular-server-iptables-no-cha), we might need a more complete description of your overall context. Do you still have any lingering rules in the nat PREROUTING chain?

Terrance

10/7/23, 5:47 AM

DNS requires that it has a return path / port for it to work or the system will not receive any answers from the outside DNS servers. See: https://simpledns.plus/kb/52/how-do-i-configure-my-firewall-for-dns

geekygeek

10/7/23, 3:55 PM

@DougSmythies I ran these commands on a brand new installation

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: DNS only works when I have a port 53 UDP outbound rule *AND INBOUND* rule

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.