forward DNS requests

Gil@LQ · 09-01-2012, 06:33 PM

hi,

can anyone help me nat the DNS requests,

Quote:

I DON'T mean forwarding DNS request from one DNS server to another

I have a gateway , client can connect to that gate way but can not connect or ping to the DNS server in the LAN, i want to make that i'll configure my GATEWAY as DNS in client and when ever my client sends DNS request's , request goes to GATEWAY IP and there my GATEWAY should redirect request to actual DNS server in my LAN...

Quote:

i always use
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination x.x.x.x:80

iptables -t nat -A POSTROUTING -j MASQUERADE

so all the web request comes on 80 port will be natted to x.x.x.x:80

any chance to nat DNS request in the same way did above

thank you.

Ser Olmy · 09-01-2012, 06:41 PM

The protocol used by DNS is (usually) udp, and the port number is 53. Change the iptables line above accordingly, and it should work.

Is that your entire firewall setup? The only way the commands above can successfully forward requests to an internal web server without an entry in the FORWARD chain of the filter table, is if the FORWARD policy is ACCEPT. If so, your setup is horribly insecure.

Gil@LQ · 09-02-2012, 07:27 AM

hi Ser Olmy,

thank for reply, i tried as you said, then i found the below result,

Quote:

C:\Users\sony>ping ns.gil.com

Pinging ns.gil.com [192.168.85.90] with 32 bytes of data:
Request timed out.
Request timed out.

if you notice the lines highlighted with red, it's my nameserver ip, so my other server redirecting perfectly as defined in iptables, but from there it's not connecting or giving reply, please tel me.

FOR YOUR INFORMATIOIN, my client is in other network, but client can connect to my other server in whcih we defined nating rule...

Ser Olmy · 09-02-2012, 07:51 AM

DNS packets and ICMP echo requests (which is what "ping" sends) are two entirely different things.

It's not at all clear what you are trying to accomplish. Your first post indicates that the "client" and the DNS server are on different sides of the gateway, but the "ping" test you just performed only makes sense if they are on the same side.

A simple diagram of your network would be a great help.