Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a local dns server on port 5300 to develop a software. I need my machine to use that dns but I wasn't able to tell /etc/resolv.conf to check on a different port. I searched a bit on google and I didn't find a solution.

I set as nameserver on /etc/resolv.conf. This is my whole /etc/resolv.conf:


Could you please tell me how can I redirect outbound traffic on port 53 to another port?

I tried the following but it didn't work:

iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT --to iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to

Here is the output of iptables -t nat -L -v -n (with suggested rules):

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REDIRECT   tcp  --  *      *             tcp dpt:53 redir ports 5300 
    0     0 REDIRECT   udp  --  *      *             udp dpt:53 redir ports 5300 

Chain POSTROUTING (policy ACCEPT 302 packets, 19213 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 302 packets, 19213 bytes)
 pkts bytes target     prot opt in     out     source               destination 
share|improve this question
show us the output of iptables -t nat -L -v -n – Iain Jun 22 '12 at 22:05
up vote 4 down vote accepted

After Andres pointing out that I need some other rules for local packet, googling a bit I found the solution.

Local generated packet ignore the PREROUTING chain of nat table while read the OUTPUT chain. With next rules, I solved my problem:

iptables -t nat -A OUTPUT -p tcp --dport domain -j DNAT --to-destination
iptables -t nat -A OUTPUT -p udp --dport domain -j DNAT --to-destination

With these rules, I don't even need to change my /etc/resolv.conf.

share|improve this answer

Try the following:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 53 -j REDIRECT --to-port 5300

share|improve this answer
Doesn't work. It continues to say it can't reach the server. But I can reach it with dig -p 5300 @localhost. – Zagorax Jun 22 '12 at 21:31
Try this first: echo "1" > /proc/sys/net/ipv4/ip_forward it shouldn't be required and I just tested that on my box... are you running dig from the same PC? – AndresSM Jun 22 '12 at 21:33
Yes, I'm running it from the same PC. No change with that extra command. – Zagorax Jun 22 '12 at 21:45
It won't work from the same PC it would work from other PCs though. iptables won't filter packets originating on the same PC I think at least not with just that command – AndresSM Jun 23 '12 at 2:46
Well. I didn't know this. But I need it on the same PC, I'm going to rename the question to be more specific. Thank you. – Zagorax Jun 23 '12 at 7:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.