Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it:

$ iptables --list -v

Chain INPUT (policy DROP 8886 packets, 657K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    2   122 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 
20738 5600K ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  eth1   any     anywhere             node1.com multiport dports http,smtp 
    0     0 ACCEPT     udp  --  eth1   any     anywhere             ns.node1.com udp dpt:domain 
    0     0 ACCEPT     tcp  --  eth1   any     anywhere             ns.node1.com tcp dpt:domain 
    0     0 ACCEPT     all  --  eth0   any     node2.backend        anywhere            
   21  1260 ACCEPT     all  --  eth0   any     node3.backend        anywhere            
    0     0 ACCEPT     all  --  eth0   any     node4.backend        anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 15804 packets, 26M bytes)
 pkts bytes target     prot opt in     out     source               destination

nmap -sV -p 53 ns.node1.com // From remote server

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2011-02-24 11:44 EST
Interesting ports on ns.node1.com (1.2.3.4):
PORT   STATE    SERVICE VERSION
53/tcp filtered domain

Nmap finished: 1 IP address (1 host up) scanned in 0.336 seconds

Any ideas?

Thanks

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

I notice that zero packets have actually reached your iptables ACCEPT rules for DNS. I think it is likely that your iptables rules are specifying an inconsistent combination of conditions that never match incoming DNS queries.

In your case, your DNS ACCEPT rules specify that the incoming interface must be eth1, and the destination IP address must resolve to ns.node1.com. You should check whether incoming DNS queries to ns.node1.com can ever arrive over the eth1 network interface.

Another possibility is that you have another packet filter somewhere between your test client and your server that is blocking DNS packets.

share|improve this answer
    
Thanks, I will look into this. The port unblocks when I stop iptables, which rules out a packet filter above my server causing the problem. –  Tom Feb 25 '11 at 1:46
    
After removing all firewall rules except iptables -A INPUT -i eth1 -j ACCEPT the port is still blocked. When I stop iptables it's open. Any ideas now? –  Tom Feb 25 '11 at 2:50
    
@Tom: Clearly, your test packets are not hitting the ACCEPT rule, otherwise the port would not be blocked. The most likely conclusion is that your test packets are not arriving on eth1. Are you certain that eth1 is where they should be arriving? –  Steven Monday Feb 25 '11 at 16:22
    
I'm not sure, but I'll explain my setup - eth0 has the private IP and eth1 has the main IP, eth1:0 is the nameserver (and the desired destination for the packets) and eth1:1 is for nginx. My other 2 servers have identical interfaces and interface aliases. The only difference I can think of is eth1:0 on the other 2 servers are for slave nameservers and eth1:0 on this server is for the master nameserver. Does that provide any insight? Appreciate your help--this is really killing me. –  Tom Feb 25 '11 at 17:29
    
I should mention, I've always had these standard rules in the bash script before and after the rules to control services: iptables -F; iptables -Z; iptables -A INPUT -i lo -j ACCEPT; iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; ## rules to control services here ## iptables -P OUTPUT ACCEPT; iptables -P INPUT DROP; iptables -P FORWARD DROP; –  Tom Feb 25 '11 at 17:35
show 3 more comments

Likely to tcp port is blocked by another firewall. Use tcpdump/Wireshark to debug problem.

From me:

nmap -sV -p 53 x.x.x.x

Starting Nmap 5.00 ( http://nmap.org ) at 2011-02-25 02:32 YEKT
Interesting ports on x.x.x.x:
PORT   STATE SERVICE VERSION
53/tcp open  domain  ISC BIND Not available
share|improve this answer
    
When I stop iptables the port becomes open. –  Tom Feb 25 '11 at 1:48
add comment

DNS uses the UDP protocol, not TCP.

share|improve this answer
1  
I forget the source but I read that accepting tcp was also necessary. Regardless, I'm already accepting UDP as you can see. Moreover, the same rules work on the other nodes. –  Tom Feb 24 '11 at 20:59
    
DNS can use both UDP and TCP. –  John Gardeniers Feb 24 '11 at 23:18
    
Why has this answer received 2 votes? It doesn't answer the question and is incorrect -- after checking again why I have a tcp rule, bind uses tcp for larger queries. –  Tom Feb 25 '11 at 1:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.