Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost programs and intranet clients in a way, I don't fully understand, that is why I am afraid of any reconfigurations to the DNS service itself. However I thought that if I deny all DNS requests from outer internet, it may solve my problems.

My questions are:

1) How to deny all DNS requests from outer internet using iptables, leaving localhost and intranet (IP: 10.0.0.X and 10.0.1.X) intact?

2) Won't it harm usability of DNS service from intranet?

3) Won't it harm usability of other internet services (web+mail+db) on the server?

All currently used domains by our websites are managed by another company on their server, nobody from outer internet should need access to our DNS service up to my knowledge.

Thank you.

share|improve this question
Rather than blocking access in the firewall, you might want to consider just getting the DNS server to listen on the intranet-facing addresses only. – nickgrim Mar 4 '13 at 10:54
I edited named.conf by adding line "listen-on {;;; };" into option sections. Is that all? Seems like it is working fine. Thank you. – David162795 Mar 5 '13 at 13:23
up vote 1 down vote accepted

The easiest way to remove access from the outside would be to block all external access to UDP (and possibly TCP) port 53, that will stop it serving requests outwards, but leave outgoing traffic to port 53 open, that way it can make recursive requests for your internal servers.

If you're going to offer a recursive nameserver to the internet, it's advisable that you know a good deal about the security and configuration of your server. Otherwise, leave it to the professionals, or hosting services.

share|improve this answer

You don't need Netfilter/iptables for that. All recursive name server software allow you to answer only to the local network. Assuming your network is, with Unbound:

access-control: refuse
access-control: allow

With BIND :

acl mynet {;
allow-recursion   { mynet; };
allow-query-cache { mynet; };
share|improve this answer
While that is certainly the most straightforward way, if he has no need to provide DNS service to anyone outside of his intranet, what possible reason is there to leave the port open? – NickW Mar 7 '13 at 10:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.