My iptables script is blocking incoming/outgoing DNS

Question

Here's the iptables script:

echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -N TCPIN
iptables -N UDPIN
iptables -N TCPOUT
iptables -N UDPOUT
iptables -N VALIDTCP
iptables -N LOGDROP

iptables -A INPUT -p tcp -j VALIDTCP
iptables -A INPUT -p tcp -j TCPIN
iptables -A INPUT -p udp -j UDPIN
iptables -A OUTPUT -p tcp -j VALIDTCP
iptables -A OUTPUT -p tcp -j TCPOUT
iptables -A OUTPUT -p udp -j UDPOUT

iptables -A TCPIN -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A TCPIN -p tcp -m state --state NEW --dport 2122 -j ACCEPT
iptables -A TCPIN -p tcp -m state --state NEW --dport 80 -j ACCEPT
iptables -A TCPIN -p tcp -m state --state NEW --dport 443 -j ACCEPT

iptables -A UDPIN -p udp --dport 53 -j ACCEPT
iptables -A TCPIN -p tcp -m state --state NEW --dport 53 -j ACCEPT

iptables -A LOGDROP -j LOG --log-ip-options --log-tcp-options --log-level debug --log-prefix IPTABLES:
iptables -A LOGDROP -j DROP

iptables -A VALIDTCP -p tcp --tcp-flags ALL NONE -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags ACK,FIN FIN -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags ACK,PSH PSH -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags ACK,URG URG -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags SYN,RST SYN,RST -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGDROP
iptables -A VALIDTCP -p tcp --tcp-flags FIN,RST FIN,RST -j LOGDROP

As soon as I apply that, my DNS lookups all fail... What's wrong with it? :/

Answer 1

iptables -A INPUT -p tcp -j VALIDTCP

iptables -A INPUT -p tcp -j TCPIN

rules are compared in order, and the -j means "jump to" - so nothing will jump to the TCPIN chain, as all tcp packets just got redirected elsewhere.

also, this looks like a hugely overly complicated setup for such a small firewall. keep it simple :-)

this is untested, but would this not do essentially the same thing (i ditched the tcp flag checking, but feel free to re-add it)

echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 2122 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
iptables -A INPUT -j LOG --log-ip-options --log-tcp-options --log-level debug --log-prefix IPTABLES:

i.e: allow traffic outbound (including dns requests) - then allow that traffic back in via the "related, established" rule. And also allow new connections on ports 80,443,2122 (which then get matched on the same related from then on). Everything else is ditched by the default -P DROP rule.