Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco (877) router acting as the main gateway for a network; it has a DSL connection and performs NAT from the internal network to its external, public IP address.

The router allows SSH access for management, and this has been limited using an access list:

access-list 1 permit <internal network range>

line vty 0 4
    transport input ssh
    access-class 1 in

The router's internal web server isn't enabled, but if it was, I know its access could be limited using the same logic:

ip http access-class 1

Now, the gotcha: this router also acts as a DNS server, forwarding queries to external servers:

ip name-server <ISP DNS 1>
ip name-server <ISP DNS 2>
ip dns server

My problem is: the router is perfectly happy to answer DNS queries when receiving them on its external interface.

How can I block this kind of traffic so that the router only answers DNS queries from the internal network?

share|improve this question
up vote 4 down vote accepted
!Deny DNS from Public 
 ip access-list extended ACL-IN_FROM-WAN
  remark allow OpenDNS lookups
  permit udp any eq domain
  permit tcp any eq domain
  remark deny all others and log the attempts
  deny   udp any any eq domain log
  deny   tcp any any eq domain log
  permit ip any any

! Apply to WAN interface
 int WAN
  ip access-group ACLIN-TO_WAN in
share|improve this answer
While in theory this answers the question it would be best if you explained what this is. – Jacob Jun 19 '14 at 6:49
Please feel free to edit your post to make it readable and understandable. – Deer Hunter Jun 19 '14 at 8:25
This ACL works, but it causes a problem: it's impossible to perform DNS queries to any other server from inside the network, because the reply can't come back. How can this be avoided? – Massimo Jul 26 '15 at 16:46

Put an ACL on the external interface. Works just the same. Make an ACL, extended or regular, then apply it but on the external interface, allowing only the traffic you want. Regardless of DNS you should have that.

I haven't tried that myself (wouldn't run a DNS on my routers)... but this seems to be what you are looking for:

DNS View Usage Restrictions Based on the Query Source IP Address

A standard IP ACL is a numbered or named set of host IP address-matching rules, with each rule specifying the type of action to be performed if an IP address matches the text string pattern in the rule. The Split DNS feature supports the use of a standard ACL as a view-use restriction based on the query source IP address. In order for a source IP address to match a name list, the IP address must match a rule that explicitly permits a matching pattern but the IP address cannot match any rules that explicitly deny a matching pattern.

share|improve this answer
Ok, so this is not to be handled at the service level (like SSH and HTTP) but at the interface level? – Massimo Feb 26 '14 at 21:05
I really don't see any other way. – ETL Feb 26 '14 at 21:14
I tried, but there's a problem: I can successfully block incoming UDP/53 packets on the external interface... but then DNS replies from Internet DNS servers are blocked too! – Massimo Feb 26 '14 at 21:31
Maybe post your ACL and how you applied it. – ETL Feb 26 '14 at 22:42
A deny for UDP/53 packets coming from anywhere, applied as an input ACL to the external interface. Unfortunately, UDP is connectionless, thus the router can't tell if a packet is a new DNS query coming from a complete stranger, or an answer to a query it started iself... – Massimo Feb 26 '14 at 22:59

I would add a comment but I cannot. The answer is to simply add an allow statement for your DNS servers that you use so if you're using Google's then add a permit statement for udp port 53 from above your deny statement.

OR use reflexive ACLs:

share|improve this answer

There's a simpler way to do it with NAT:

ip nat inside source static udp 53 interface GigabitEthernet0/0 53 

(With an 877 I guess your external interface would be Dialer0 or atm0.1 depending on if you use ppp, instead of Gi0/0 - whatever has "ip nat outside" on it)

This should divert all incoming connections, but all connections going out from the inside should have a matching entry in the NAT table and work. This also necessitates that you specify your internal interface as the source lookup interface:

ip domain lookup source-interface Vlan1

(substitute your own internal interface for Vlan1 if you're using something else)

And that should do the trick.

share|improve this answer

If one had an outside interface G0/1 with IP This ACL will block requests specifically coming from outside trying to hit your outside interface, while leaving other forms of DNS traffic unaffected.

 ip access-list extended Outside-In
    deny   udp any host eq domain
    deny   tcp any host eq domain
    permit ip any any
interface GigabitEthernet0/1
 ip access-group Outside-In in
share|improve this answer
Sorry, this is completely wrong. This ACL would also block DNS replies from reaching the router when it (or some machine inside the LAN) performs DNS queries to external servers, effectively blocking DNS resolution. – Massimo May 12 at 18:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.