Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I set my server to reject ALL incoming UDP packets, to prevent UDP floods. However, I was told that because I use my own domain and server for my nameservers, this can cause some problems. How can I get around that?

My firewall is iptables, my distro is CentOS5.5.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

If you are following the standard security practices, then your default firewall policy will be to block everything. All you should have to do is write a rule to permit tcp and udp traffic to port 53 if you want to permit incoming DNS requests.

The traffic you are talking about is UDP. UDP is stateless. This means that people interested in saturating your connection can send the packets to your address even if you just drop them. Still you may be able to do something semi-useful with the iptables recent match, to only allow a limited ammount of traffic to actually be accepted and processed by the system. Evan has a example of the usage of this for SSH here. We might have to see your entire firewall rule set to tell you what rules would have to be added.

If you have a serious DoS against your system, you would almost certainly need your ISP to help you, trying to deal with a flood with a host-based firewall on a VPS will really not be very useful.

If you don't have it already, you should consider setting up a few secondary DNS servers for your zones on a completely different network.

share|improve this answer
Well the problem with that, is then users could easily flood me on port 53, right? –  Rob Jan 14 '11 at 18:38
Yes. So you're choices are: 1. Don't run your own DNS servers or 2. Live with the risk. –  joeqwerty Jan 14 '11 at 18:46
I'm sorry, I'm quite terribly new at running my own server. The whole DNS server thing, is that my resolvers? I currently have those set to GoogleDNS ( and, so would it matter? –  Rob Jan 14 '11 at 18:48
Yes, any port can be flooded: that's why good firewall can detect floods & can do things like packet inspection. You would still need upstream help from your ISP or their suppliers to help with serious DDOS attacks. –  DutchUncle Jan 14 '11 at 18:53
@Zoredache can you show me the rule to allow UDP only on port 53, but with a connection limit? –  Rob Jan 14 '11 at 19:17

Do you actually need to allow strangers on the internet to run DNS queries against your server? I suspect you just need to make sure that your firewall allows your server to make outgoing DNS requests.

With firewalling you start by blocking everything and then being very precise/detailed about opening up specific combinations of port/service/protocol and limit it by IP address (range).

share|improve this answer

In Iptables, Accept incoming UDP traffic to port 53 & reject everything in the port range for static ports.

The highest limit (here 32767) should not be too high otherwise, your server will be unable to resolve external domains (for instance when you do a "ping google.com") from inside your server. On a linux OS, 32768 is the first ephemeral port for dynamic sockets up to 61000. Thus, 32767 is the highest port for static allocated ports.

-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 1:32767 -j DROP

To get your local dynamic (also called ephemeral or private) port ranges for UDP & TCP. FYI, Linux OS aren't compliant with IANA. :

 cat /proc/sys/net/ipv4/ip_local_port_range

Then, if you want to open a port for UDP like a VPN port, just add an ACCEPT like before the DROP line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.