[ILUG] iptables and DNS

[Dave Hickey]

I'm having an interesting problem with DNS behind an iptables firewall. This 
is a public addressed lan connecting to the internet through the firewall. The 
lan is routed to the public interface on the firewall.

I have a network with 2 DNS servers behind the firewall. The firewall is a 
2.4.17 kernel on redhat 7.1 (all updates applied). Netfilter is built into the 
kernel.

The rules on the firewall are set to allow forwarding of all UDP traffic from 
anywhere to anywhere. The INPUT, OUTPUT and FORWARD chains have default 
policies of accept.

When I query the DNS for a zone that it is authoritative for I get an answer. 
If I query a zone that it is not authoritative for I get a time out after 2 
seconds. If I run the same query on the dns server I get an answer.

I have tried explicitly accepting port 53 from anywhere and explicitly letting 
all traffic from the protected lan back out. I have also tried letting 
everything through with all chains set to default accept and no rules.

Has anyone seen this happen before? Any suggestions appreciated.

Regards,
Dave.




-- 

Dave Hickey           david.hickey at esat.net
Esat IP NOC           www.esat.net