LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-02-2012, 06:55 PM   #1
dmz1213
Member
 
Registered: Aug 2012
Posts: 40

Rep: Reputation: Disabled
DNS and iptables


Configure a cache-only DNS server on 198.4.195.45.
I have the default /etc/named.conf file, with 2 modifications:

listen-on port 53 { 127.0.0.1; 198.4.195.45; };
allow-query { localhost; 192.168.122.0/24; };

/etc/sysconfig/iptables:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [110:14686]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5900:5904 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i eth+ -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Iptables is enabled on 198.4.195.45. From server 192.168.122.5, entering
# dig@198.4.195.45 cnn.com
; <<>> DiG 9.7.0-P2-RedHat-9.7.0-5.P2.el6 <<>> @198.4.195.45 cnn.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
There is no DNS related query activity is record on 198.4.195.45s messages file.
If I stop iptables on 198.4.195.45, dig command resolves cnn.com.
Iptables L shows

ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:domain

Port 53 is opened. Is there any other port need to be open? What do I miss?
Thanks.
 
Old 12-02-2012, 08:27 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,361
Blog Entries: 55

Rep: Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547Reputation: 3547
Quote:
Originally Posted by dmz1213 View Post
Code:
        listen-on port 53 { 127.0.0.1; 198.4.195.45; };
        allow-query     { localhost; 192.168.122.0/24; };
If I read this correctly you have a caching-only name server set to serve your 192.168.122.0/24 range only. It should not listen on its public interface.


Quote:
Originally Posted by dmz1213 View Post
-A INPUT -i eth+ -j ACCEPT
Apart from re-ordering your rule set I've never seen network device notation using a plus sign...


Quote:
Originally Posted by dmz1213 View Post
# dig@198.4.195.45 cnn.com
If you intend the caching-only name server to only serve your LAN, after all you set a strict "allow-query" rule, then what should accessing it via its public IP accomplish?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables and dns dedexes Linux - Networking 3 02-19-2008 12:01 AM
iptables - for dns rickylim Linux - Security 3 11-17-2006 03:20 AM
Iptables and DNS IBall Linux - Security 6 03-03-2006 06:08 AM
iptables and DNS ujotne Linux - Security 8 09-12-2005 08:49 AM
DNS and IPTABLES cuco76 Linux - Networking 9 02-07-2004 10:12 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 01:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration