[ILUG] iptables and DNS
davidh at esat.net
Tue Jan 22 12:49:22 GMT 2002
I'm having an interesting problem with DNS behind an iptables firewall. This
is a public addressed lan connecting to the internet through the firewall. The
lan is routed to the public interface on the firewall.
I have a network with 2 DNS servers behind the firewall. The firewall is a
2.4.17 kernel on redhat 7.1 (all updates applied). Netfilter is built into the
The rules on the firewall are set to allow forwarding of all UDP traffic from
anywhere to anywhere. The INPUT, OUTPUT and FORWARD chains have default
policies of accept.
When I query the DNS for a zone that it is authoritative for I get an answer.
If I query a zone that it is not authoritative for I get a time out after 2
seconds. If I run the same query on the dns server I get an answer.
I have tried explicitly accepting port 53 from anywhere and explicitly letting
all traffic from the protected lan back out. I have also tried letting
everything through with all chains set to default accept and no rules.
Has anyone seen this happen before? Any suggestions appreciated.
Dave Hickey david.hickey at esat.net
Esat IP NOC www.esat.net
More information about the ILUG