9

I am having problem opening port 53 on my centos machine, for DNS configuration.

Here is my iptables config

-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

When I ran a nmap scan of the machine only port 80 showed up as open on it. Am I missing anything?

EDIT:

Full iptable

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -p udp -m state --state NEW,ESTABLISHED -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT -reject-with icmp-host-prohibited
-A FORWARD -j REJECT -reject-with icmp-host-prohibited
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
COMMIT 
5
  • What was the nmap command line you used? May 17, 2013 at 14:38
  • nmap 192.168.1.2 May 17, 2013 at 14:39
  • 1
    maybe you have a DROP before. -A add these rules at the end of chains. May 17, 2013 at 14:39
  • An iptables --list would be handy to see. You'll also want to disable the firewall in system-config-firewall-tui (or in your gui), so that you can manually set it with iptables commands, otherwise, it will re-write your iptables if you use that. Bonus tip, in centos (at least) you can do a service iptables save when you're done, so the changes stick for the next reboot.
    – dougBTV
    May 17, 2013 at 14:43
  • 2
    You allow UDP only but nmap does not test UDP ports by default. You need this: nmap -sU -p 53 $host May 17, 2013 at 14:54

3 Answers 3

13

Your semantics are reversed.

The rules you posted permit outgoing DNS connections to a remote DNS server, not incoming connections to a local DNS server.

To permit connections to your local DNS server, reverse the INPUT and OUTPUT rules:

-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 53 -j ACCEPT

(And please take a few minutes at some point to revise your firewall to be stateful.)

3
  • 2
    You may also want to optionally allow TCP connections if doing AFXR or other DNS transfers. May 17, 2013 at 15:50
  • Don't block TCP queries on DNS server. Some responses, like www.google.com will not fit in UDP packet and need to be repeated by TCP. TCP is not only for DNS transfers - it is required for normal queries.
    – Tometzky
    May 19, 2013 at 20:00
  • Why mention stateful and not show rules that are actually stateful? Oct 20, 2022 at 4:58
3

Use -I instead of -A .

As you have a DNS server listening then it will be listening on port 53 so the input rule should be

-I INPUT -p udp -m udp --dport 53 -j ACCEPT
0
0

Are you sure the DNS server is actively running? Even if you have the port open, the service needs to be active. You can verify what is listening locally by running a netstat command. Also, have you tried completely turning off the firewall momentarily just to see what shows up?

3
  • Yes, I am sure that the DNS is running. If i turned of the iptables, and run nmap on my other machine the port is shown as open. May 17, 2013 at 14:38
  • Can you post your full iptables config?
    – Eric
    May 17, 2013 at 14:40
  • post update see above May 17, 2013 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .