I'm having a problem with redirecting pc's dns requests to a local dns server. I want to block access to other dns services except my own. I've found different methods of doing this, none work here. So I must be doing something wrong.
A lot of people suggest using this:
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to 192.168.2.70:53
But in my config this blocks access to DNS. Also I cannot find why this should work in the first place. Since prerouting is for external users that want access to an internal service right?
I also tried specifying the internal lan interface -i eth1 but, this just cannot work since the internal servers are also on the same interface. That would make a loop right? Servers sends out packets for port 53 and the gateway sends it back to the same server.
Then I would also like to ONLY allow the dns servers on my internal network, to contact other external dns servers. Like:
iptables -A OUTPUT -p udp -s 192.168.2.70 -d 208.67.222.222 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.2.70 -d 208.67.222.220 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -s 192.168.2.72 -d 208.67.222.222 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.2.72 -d 208.67.222.220 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
But I'm guessing that the OUTPUT table is not correct. Since from what I learned, INPUT and OUTPUT are only for the local linux router no?
Information:
Internal dns servers: 192.168.2.70 and 192.168.2.72
External dns server: 208.67.222.220 and 208.67.222.222
LAN interface: ETH1
WAN interface: ETH0
My current firewall config without prerouting&forward rules except one to show how it's configed.
#!/bin/sh -e
ifconfig eth1 192.168.2.1/24
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#Flush table's
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
#toestaan SSH verkeer
iptables -t nat -A PREROUTING -p tcp --dport 22 -i eth0 -j DNAT --to 192.168.2.1
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#Drop traffic and accept
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
#verkeer naar buiten toe laten en nat aanzetten
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -m limit --limit 1/minute --limit-burst 1 -j ACCEPT
iptables -A INPUT -p tcp -m state --syn --state NEW --dport 22 -j DROP
#toestaan verkeer loopback
iptables -A INPUT -i lo -j ACCEPT
#toestaan lokaal netwerk
iptables -A INPUT -i eth1 -j ACCEPT
#accepteren established traffic
iptables -A INPUT -i eth0 --match state --state RELATED,ESTABLISHED -j ACCEPT
#droppen ICMP boodschappen
iptables -A INPUT -p icmp -i eth0 -m limit --limit 10/minute -j ACCEPT
iptables -A INPUT -p icmp -i eth0 -j REJECT
#RDP forward voor windows servers
iptables -t nat -A PREROUTING -p tcp --dport 3389 -i eth0 -j DNAT --to 192.168.2.73
iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
Best Answer
You need to put these rules in FORWARD chain:
Give users local DNS servers addresses via DHCP and do not bother to redirect their DNS traffic to local servers - if they manipulate with their network configuration (DNS servers configuration), they will just fail.