DNS server filter using iptables in linux

23
2014-07
  • Questioner

    I am trying to use bind9 on debian as a DNS server. It was working until I added iptables firewall. I have tried the following filter but it does not seem to work. Anyone can help?

    # DNS
    -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT --syn
    -A INPUT -p udp -m udp --dport 53 -j ACCEPT
    -A INPUT -p udp -m udp -s 0/0 -d 0/0 --sport 53 -j ACCEPT**
    

    My complete filter is, the bold is actually a commented line using '#' which I could not find how to prevent:

    *filter

    # Samba
    -A INPUT -p udp -m udp --dport 137 -j ACCEPT
    -A INPUT -p udp -m udp --dport 138 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
    
    # SYN Flood Protection
    -A INPUT -p tcp --syn -m limit --limit 5/second -j ACCEPT
    
    # Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
    -A INPUT -i lo -j ACCEPT
    -A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT
    
    # Accepts all established inbound connections
    -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    
    # Allows SSH connections
    # THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE
    -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
    
    # My webmin custom port
    -A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
    
    #POP mail <br>
    -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT --syn
    
    #SMTP Traffic <br>
    -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT --syn
    
    #HTTP <br>
    -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn
    
    #HTTPS <br>
    -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT --syn
    
    # IMAP mail services <br>
    -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT --syn
    
    # Allow ping
    -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
    
    # DNS
    -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT --syn
    -A INPUT -p udp -m udp --dport 53 -j ACCEPT
    -A INPUT -p udp -m udp -s 0/0 -d 0/0 --sport 53 -j ACCEPT
    
    # Localhost traffic <br>
    -A INPUT -i lo -j ACCEPT
    
    # log iptables denied calls (access via 'dmesg' command)
    -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
    
    # Reject all other inbound - default deny unless explicitly allowed policy:
    -A INPUT -j REJECT
    -A FORWARD -j DROP
    
    # The below commits the rules to production for iptables to execute <br>
    COMMIT 
    
  • Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

    Related Question

    My iptables script is blocking incoming/outgoing DNS
  • Questioner

    Here's the iptables script:

    echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
    echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
    
    iptables -F
    iptables -X
    iptables -Z
    
    iptables -P INPUT DROP
    iptables -P FORWARD DROP
    
    iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j DROP
    
    iptables -A INPUT -i lo -j ACCEPT
    iptables -A OUTPUT -o lo -j ACCEPT
    
    iptables -N TCPIN
    iptables -N UDPIN
    iptables -N TCPOUT
    iptables -N UDPOUT
    iptables -N VALIDTCP
    iptables -N LOGDROP
    
    iptables -A INPUT -p tcp -j VALIDTCP
    iptables -A INPUT -p tcp -j TCPIN
    iptables -A INPUT -p udp -j UDPIN
    iptables -A OUTPUT -p tcp -j VALIDTCP
    iptables -A OUTPUT -p tcp -j TCPOUT
    iptables -A OUTPUT -p udp -j UDPOUT
    
    iptables -A TCPIN -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
    
    iptables -A TCPIN -p tcp -m state --state NEW --dport 2122 -j ACCEPT
    iptables -A TCPIN -p tcp -m state --state NEW --dport 80 -j ACCEPT
    iptables -A TCPIN -p tcp -m state --state NEW --dport 443 -j ACCEPT
    
    iptables -A UDPIN -p udp --dport 53 -j ACCEPT
    iptables -A TCPIN -p tcp -m state --state NEW --dport 53 -j ACCEPT
    
    iptables -A LOGDROP -j LOG --log-ip-options --log-tcp-options --log-level debug --log-prefix IPTABLES:
    iptables -A LOGDROP -j DROP
    
    iptables -A VALIDTCP -p tcp --tcp-flags ALL NONE -j LOGDROP
    iptables -A VALIDTCP -p tcp --tcp-flags ACK,FIN FIN -j LOGDROP
    iptables -A VALIDTCP -p tcp --tcp-flags ACK,PSH PSH -j LOGDROP
    iptables -A VALIDTCP -p tcp --tcp-flags ACK,URG URG -j LOGDROP
    iptables -A VALIDTCP -p tcp --tcp-flags SYN,RST SYN,RST -j LOGDROP
    iptables -A VALIDTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGDROP
    iptables -A VALIDTCP -p tcp --tcp-flags FIN,RST FIN,RST -j LOGDROP
    

    As soon as I apply that, my DNS lookups all fail... What's wrong with it? :/


  • Related Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.