Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use a ubuntu server as a router for my users on a NAT network. I want to force all users to use a local dns server setup on the network. Even if they use a public DNS server in their client machines, the DNS port should be redirected (DNAT) to my local DNS server. This is what I have come up with:

iptables -t nat -A PREROUTING -i eth5 -p udp --dport 53 -j DNAT --to
iptables -A FORWARD -d -i eth5 -p udp --dport 53 -j ACCEPT

The interface facing NAT network is eth5. The above rules were not working for me. Are there any better solutions?

EDIT 1: My aim is to implement Opndns filter to prevent bittorrent traffic on the network. The filter is working quite well at present, and the users get the local dns server because they use DHCP. But I fear that they might discover a work around, like, specifying ip address and dns server ip's manually.

EDIT 2: The following code implements the feature on tomato firmware:

 if (nvram_match("dns_intcpt", "1")) {
     ipt_write("-A PREROUTING -p udp -s %s/%s ! -d %s/%s --dport 53 -j DNAT --to-destination %s\n",
          lanaddr, lanmask,
          lanaddr, lanmask,

Here is more about it.

share|improve this question
Doesn't answer your question, but thought it worthwhile to point out that DNS is not exclusively UDP -- if the answer to a query is > 512 bytes, it will switch to TCP. – Kanji Aug 5 '11 at 17:22
@Kanji more accurately, if the TC bit is set in the response, it'll switch to TCP. RFC 2671 allowed for UDP responses longer than 512 bytes. – Alnitak Aug 5 '11 at 17:26

Are there any better solutions?

Yes - not doing it at all.

Messing with normal DNS resolution is almost never the right answer, whatever the problem is that you're trying to solve.

EDIT re: your update. Your are inappropriately trying to use technology to solve a policy problem. Don't.

share|improve this answer
+1 for 'not doing it at all'. KISS almost always wins. – MikeyB Aug 5 '11 at 17:37
I was using tomato firmware earlier, and it had a DNS intercept feature. It worked extremely well. I monitor my network frequently. To detect bitorrent I use this command: iftop -pPB -i eth5. If same port is being used by many WAN ip's, to connect to a LAN ip, then the traffic is bittorrent. And I used to ban those clients. So ultimately there was no bittorrent traffic on the network. Now, I use a ubuntu server as a router. So I am looking for a way to intercept the DNS port. – nixnotwin Aug 7 '11 at 5:44

It's not working because the reply from your DNS server is bypassing the firewall. The clients will then (correctly) drop those responses as they don't match what was sent out.

You need to add another rule to your POSTROUTING table to SNAT the packets headed for the DNS server to the router's IP.

Alternatively, putting the DNS server on a separate network would solve the problem as the responses would be forced back through the router.

share|improve this answer

Why not just drop DNS traffic to any external DNS server? Those who explicitly specify an external server will simply notice that that isn't working.

share|improve this answer
and a determined user will tunnel their DNS requests off net on a different port, or just use IPs, or any other number of work arounds. Policy problems are very rarely solved using technology - they are solved by having real sancations for breaches of those policies. – Alnitak Aug 7 '11 at 12:34
@Alnitak: of course this doesn't stop the very perseverant, but it's a simple measure that works reasonably well. That car theft is illegal doesn't mean you leave your car keys in the contact, right? – eldering Aug 8 '11 at 15:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.