Hi All,

I've just setup a RaspberryPI using Raspbian as a Wireless access point. Traffic from wlan0 gets forwarded to eth0 (which is plugged into my router) and the traffic goes out to the web. All good.

I'm trying to restrict the traffic so DNS requests can only go to specific DNS servers. From the man pages and reading, I think I know what I need to do - explicitly allow tcp and udp on port 53 for just a particular address and block everything else. Something like this:

-A FORWARD -d 8.8.8.8 -i wlan0 -o eth0 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 8.8.8.8 -i wlan0 -o eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p udp -m udp --dport 53 -j DROP
-A FORWARD -i wlan0 -o eth0 -p tcp -m tcp --dport 53 -j DROP

When I do that, all the traffic is still let through. I'm a little unclear on where the rules go - filter or nat? And whether order is important. And whether any of the 'allow all rules' override the DROP ones.

Here's what I have now in ip tables and I restore this using iptables-restore


# Generated by iptables-save v1.4.14 on Sat Jan 25 11:41:20 2014
*nat
:PREROUTING ACCEPT [9390:898244]
:INPUT ACCEPT [4509:271576]
:OUTPUT ACCEPT [257:19408]
:POSTROUTING ACCEPT [23:1600]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Jan 25 11:41:20 2014
# Generated by iptables-save v1.4.14 on Sat Jan 25 11:41:20 2014
*filter
:INPUT ACCEPT [925:62130]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [561:116190]
-A FORWARD -d 8.8.8.8/32 -i wlan0 -o eth0 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 8.8.8.8/32 -i wlan0 -o eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p udp -m udp --dport 53 -j DROP
-A FORWARD -i wlan0 -o eth0 -p tcp -m tcp --dport 53 -j DROP
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
COMMIT
# Completed on Sat Jan 25 11:41:20 2014

Any help appreciated.

The order is important, as the rules are checked from top to bottom. A "DENY" rule below an "ACCEPT" rule for the same type of traffic (or vice versa) will have no effect.

Your FORWARD chain only drops one type of traffic: DNS traffic (packets to TCP or UDP port 53) to servers other than 208.67.222.222. Everything else is allowed, as the chain policy is ACCEPT. The policy affects any packet for which no other matching rule was found.

Since you're blocking/allowing traffic, the rules go in the "filter" table (which is the default). The "nat" table is only for manipulating addresses and port numbers.

Thanks Ser Olmy,

OK, so now I have "allow dns to my chosen dns", drop any other dns traffic, allow anything else...

I'm still able to do DNS lookups to any DNS server from devices connecting to wlan0... any other hints?

# Generated by iptables-save v1.4.14 on Sat Jan 25 11:41:20 2014
*nat
:PREROUTING ACCEPT [9390:898244]
:INPUT ACCEPT [4509:271576]
:OUTPUT ACCEPT [257:19408]
:POSTROUTING ACCEPT [23:1600]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Jan 25 11:41:20 2014
# Generated by iptables-save v1.4.14 on Sat Jan 25 11:41:20 2014
*filter
-A FORWARD -d 8.8.8.8/32 -i wlan0 -o eth0 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 8.8.8.8/32 -i wlan0 -o eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -p udp -m udp --dport 53 -j DROP
-A FORWARD -i wlan0 -o eth0 -p tcp -m tcp --dport 53 -j DROP
:INPUT ACCEPT [925:62130]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [561:116190]
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
COMMIT
# Completed on Sat Jan 25 11:41:20 2014