block dns host name resolve

user100 · 04-03-2011, 11:30 AM

Hi,

How can I best block dns host name resolving?

So that no app or whatever from inside my network can connect or forward outside my network by use of a free dns service like for example no-ip, freedns or something alike?

I guess one way is to block the ip addresses it would connect to in order to resolve a hostname. But any alternatives? Anyway to block it without using or knowing those ip addresses specifically?

And by using linux iptables.

Thanks.

win32sux · 04-03-2011, 12:37 PM

Maybe allow only the DNS servers you want? For example:

Code:

iptables -A FORWARD -p UDP -i eth0 -o eth1 --dport 53 -d 8.8.8.8 -j ACCEPT
iptables -A FORWARD -p UDP -i eth0 -o eth1 --dport 53 -j REJECT

This can easily be expanded to allow more DNS servers as well as TCP queries. For example:

Code:

iptables -A FORWARD -p UDP -i eth0 -o eth1 --dport 53 -d 8.8.8.8 -j ACCEPT
iptables -A FORWARD -p TCP -i eth0 -o eth1 --dport 53 -d 8.8.8.8 -j ACCEPT

iptables -A FORWARD -p UDP -i eth0 -o eth1 --dport 53 -d 8.8.4.4 -j ACCEPT
iptables -A FORWARD -p TCP -i eth0 -o eth1 --dport 53 -d 8.8.4.4 -j ACCEPT

iptables -A FORWARD -p UDP -i eth0 -o eth1 --dport 53 -j REJECT
iptables -A FORWARD -p TCP -i eth0 -o eth1 --dport 53 -j REJECT

That said, if your DNS daemon is running on your LAN then you could just block all outbound port 53 traffic, like:

Code:

iptables -A FORWARD -p UDP -i eth0 -o eth1 --dport 53 -j REJECT
iptables -A FORWARD -p TCP -i eth0 -o eth1 --dport 53 -j REJECT

user100 · 04-03-2011, 05:45 PM

Thanks for your reply.

The problem however is that the daemon/app could use any port and not necessarily connect to an ip address I know.
It would most likely not use port 53 though. It could be any port.

Noway2 · 04-04-2011, 05:02 AM

It sounds like you are in need of a proxy application. There are some commercial ones that are designed specifically for restricting traffic, such as Bluecoat. Squid being your most common open source alternative.

Fair warning, though, even if you open up plain http on port 80 and nothing else, there is no way to absolutely prevent them from "jail breaking" your proxy/firewall restrictions.