Login or Register to Ask a Question and Join Our Community


Red Hat

iptables & port 53 (DNS)

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Linux Red Hat iptables & port 53 (DNS)
# 1  
Old 04-17-2012
iptables & port 53 (DNS)
Hi,

I have a newly built RHEL5 OS that is unable to talk to the DNS server. I am unable to telnet resolv.conf entry over port 53 but apparently this port has been opened.

Code:
# telnet 209.212.96.1 53

and.....

Code:
# dig www.google.com
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> www.google.com
;; global options: printcmd
;; connection timed out; no servers could be reached

I can only assume therefore that this is a server issue.

So, I have added the following entry to my iptables:

Code:
# iptables -A INPUT -s 41.181.59.124/29 -d 209.212.96.1 -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
 
# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination 
RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0 
ACCEPT tcp -- 41.181.59.120/29 0.0.0.0/0 state NEW tcp dpt:53 
ACCEPT tcp -- 41.181.59.120/29 209.212.96.1 state NEW tcp dpt:53

But still unable to telnet to the nameserver over port 53.

Can anybody provide any pointers to what I can try next?

R,
D.
Last edited by Duffs22; 04-17-2012 at 09:42 AM..
# 2  
Old 04-17-2012
DNS is UDP... you need to allow the DNS server to talk back to the client on UDP 53
# 3  
Old 04-17-2012
I have added the following:

Code:
# iptables -A INPUT -s 41.181.59.124/29 -d 209.212.96.1 -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT

..........but still unable to reach the internet.
# 4  
Old 04-17-2012
Still hard to tell. This is iptables from client, not server, but you use dport 53... It would be sport at INPUT. Also you've an entire chain before these rules. Need output of iptables -S
# 5  
Old 04-17-2012
No "-S" option on RHEL5. I've listed the tables instead:

Code:
# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     udp  --  41.181.59.120/29     209.212.96.1        state NEW udp dpt:53 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0           
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255 
ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:53

R,
D.
# 6  
Old 04-17-2012
Couple of questions?

Without the firewall, do you have connectivity to the DNS server?

What do the logs show with iptables running when you attempt the connection?
# 7  
Old 04-17-2012
-L isn't enough. Otherwise I'd assume everything is accepted due to the first rule in RH-Firewall-1-INPUT, ... -L -v -n would be better..

But those are rather restrictive rules. You still would want to add new ones to the top rather than the bottom, use -I instead of -A
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Linux

Domain registrars & DNS servers

I have read many tutorials on bind and i understand the A,MX, CNAME records. Internally, on a LAN we can install bind and create all these records and we can tell all PC and servers to use this bind as DNS server.that's fine. On the Internet, when we have purchased a valid domain like... (5 Replies)
Discussion started by: coolatt
5 Replies

2. IP Networking

OS X & VPN DNS Issue

I'll try and be brief and detailed. I have a Macbook Pro Retina running Mavericks. When on my network at the office (work) everything local works just fine. Local servers are resolved through our internal DNS settings. For example, we have a fileserver at "fs01". I can connect to it with... (1 Reply)
Discussion started by: jbhardman
1 Replies

3. Red Hat

DHCP & DNS - Clients get IP but don't register in DNS

I am trying to setup a CentOS 6.2 server that will be doing 3 things DHCP, DNS & Samba for a very small office (2 users). The idea being this will replace a very old Win2k server. The users are all windows based clients so only the server will be Linux based. I've installed CentOS 6.2 with... (4 Replies)
Discussion started by: FireBIade
4 Replies

4. Solaris

Bind9 DNS on Solaris 10 x4270 & CPU usage

I have configured a Bind9 DNS on a X4270 machine with Solaris10 I am excuting some repformance tests with DNSPERF tool and maximun CPU usage is 23%. I have seen with prstat -L -p PID that named process usses only 2 of the 8 available CPU at the same time although threads for all CPUs exist.... (2 Replies)
Discussion started by: parisph
2 Replies

5. UNIX for Dummies Questions & Answers

DNS & DHCP configuration

Hi to all. Sorry for my bad english. For pure self-educational, not professional, purposes, I am studying how to configure a server with several services operating on it. For my experiment I'm using VirtualBox 3.1.4 on a WinXP host with 3 FreeBSD guests; one acts as a DHCP + DNS server; the... (0 Replies)
Discussion started by: marboxer
0 Replies

6. Solaris

OS Problems -no DNS & SSH not working

I just installed Solaris 6/10 without any problems but I didn't connect the network cable when I installed it. Here are my problems: -I can access webpages using IP addrsses but not with domain names -ssh is installed but it is not running ('ps -e | grep sshd' didn't show it) I have been... (4 Replies)
Discussion started by: kungpow
4 Replies

7. UNIX for Dummies Questions & Answers

FTP, DNS & BIND

Hi GURUs, I have two queries. 1)I know I can use FTP clients for my File transfer needs, but I want to learn FTP thru command line, any one can point me to some good online resource available to learn FTP command line with examples, of course free except UNIX man pages. 2) Our company has... (4 Replies)
Discussion started by: patras
4 Replies

8. Linux

LINUX 9 IPTABLES and DNS

I have installed a linux 9 router/firewall and have issues with outside DNS queries making it in. here are my IPTABLE rules, can anyone make some suggestions? ETH1 is my outside facing Interface, ETH0 is my inside facing interface. Accept If input interface is not eth1 Accept If protocol... (6 Replies)
Discussion started by: frankkahle
6 Replies

9. UNIX for Advanced & Expert Users

LINUX 9 IPTABLES and DNS

I have installed a linux 9 router/firewall and have issues with outside DNS queries making it in. here are my IPTABLE rules, can anyone make some suggestions? ETH1 is my outside facing Interface, ETH0 is my inside facing interface. Accept If input interface is not eth1 Accept If protocol is... (1 Reply)
Discussion started by: frankkahle
1 Replies

10. IP Networking

Resolving port 8080 in DNS

Hi I have my DNS servers (BIND 8) running on two Solaris 8 boxes. I need to be able to resolve an address blah.xxx.net to an IP address followed by :8080 - (for Tomcat). I tried doing this in my zone file but it failed. Can someone give me a pointer on where this configuration should be done?... (1 Reply)
Discussion started by: korfnz
1 Replies
Login or Register to Ask a Question