Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will.

How do you do this with iptables?

Many thanks.

share|improve this question
    
Your DNS server may also have ACL support for setting restrictions based on various criteria. –  Zoredache Mar 29 '12 at 15:35
add comment

1 Answer

up vote 6 down vote accepted

This is very simple with iptables:

I'll assume your INPUT chain has no default DROP rule at the end, or you'll have to work around that:

# Allow DNS (53) from <source IP>
iptables -A INPUT -p udp --dport 53 -s <source IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s <source IP> -j ACCEPT

# Deny all other DNS requests
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

Simply remove the two bottom rules if you have a default DROP policy. If you have a default DROP rule at the bottom of your chain, you'll have to insert (-I rulenum) these rules above that rule.

share|improve this answer
2  
Edited your answer to add TCP ports, pending review. –  gparent Mar 29 '12 at 13:59
2  
Approved, but I want to double-check this. I believe TCP is only used for IXFR/AXFR transfers? –  Kyle Smith Mar 29 '12 at 14:03
3  
Looks like I'm wrong! Thanks for pointing this out, @gparent. DNS does a "renegotiation" to TCP for large responses. –  Kyle Smith Mar 29 '12 at 14:04
1  
That's why I contribute here, learn something new every day :-) –  Kyle Smith Mar 29 '12 at 14:06
1  
@ale: Your secondary DNS probably needs to talk to your primary DNS in addition to the IPs you already specify, but that should be it. –  gparent Mar 29 '12 at 18:09
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.