2
votes
0answers
29 views

Are DNS server responses categorized as “ESTABLISHED” by iptables? If so, why? [duplicate]

CentOS 5.x I'm trying to confirm which specific rule in my iptables config is allowing return UDP traffic from my DNS server. I THINK, it's this one: -A RH-Firewall-1-INPUT -m state --state ...
-1
votes
2answers
35 views

Forward Clients to New Server using iptables

Clients are connected to a server A by connecting to the domain name address www.example.com:4444, where www.example.com resolves to the IP address of server A. Question: In order to provide a ...
1
vote
1answer
88 views

Iptables prerouting based on destination's DNS name?

I've got a question concerning iptable prerouting. I'm not that familiar with networking/routing/iptables so I hope this is not a stupid question, at all. So I ask for your understanding and ...
1
vote
1answer
101 views

Debian 7.2 (wheezy) - Block domain

0 down vote favorite A few days ago I figured out that someone was trying to get access to my mailserver, obviously to send spam emails through. After some research I found out that the sender uses ...
0
votes
1answer
173 views

Best way to whitelist 1e100.net?

I'm trying to block all http/s traffic and whitelist a very small handful of websites. iptables works well to whitelist simple websites. It falls apart on the asynchronous client-to-other ...
0
votes
2answers
184 views

My Centos 6.4 doesn't accept dns requests

I've a problem with my dns server on my new installed centos 6.4 system. I went though tutorials, try configurations of iptables but can't find a solution. I've installed bind, created a config file ...
0
votes
0answers
62 views

can i forward internet from 2 public ip to 1 single private ip (network)? [duplicate]

I am rahul and i am new on centos 6. can anyone tell me .. is it possible suppose i have 3 nic cards in the same system and i have 2 nic cards for public ip(Eth1 and Eth2) and default Ethernet for ...
-1
votes
2answers
245 views

Use Domain in iptables PREROUTING

I have a www.example.com with X.X.Y.Y ip i want to forward traffic from port 80 to the domain(www.example.com), I used the following iptable: iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT ...
0
votes
1answer
117 views

postfix doesn't work after iptables set up

here's my problem: # iptables -P INPUT DROP # host -t mx gmail.com ;; connection timed out; no servers could be reached # iptables -P INPUT ACCEPT # host -t mx gmail.com gmail.com mail is handled by ...
-5
votes
1answer
413 views

iptables block access to port 53 [closed]

I would like to block access to any DNS server (port 53) except for my own $DNS_IP1, $DNS_IP2. $DNS_IP1, $DNS_IP2 are not part of my IP range but are out IPs.
0
votes
1answer
324 views

Log DNS queries (Source IP, Record Type, Hostname) using iptables

I'm looking for a way to log DNS queries using iptables for vpn users. What I'm looking for is to record in the syslog the source IP, the Record type and the domain name for new DNS queries. I've ...
5
votes
2answers
329 views

Linux: Block IPv6 for certain applications / hostnames

Problem and aim We don't get IPv6 from our ISP thus I have an IPv6 tunnel which works fine but is, of course, not very fast. And not really reliable. I like to have IPv6 available "just in case" but ...
4
votes
4answers
2k views

Making iptables easier to maintain

My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this: # Allow traffic to google.com iptables -A ...
0
votes
1answer
2k views

gateway iptables dns redirect

I'm having a problem with redirecting pc's dns requests to a local dns server. I want to block access to other dns services except my own. I've found different methods of doing this, none work here. ...
0
votes
1answer
2k views

I can connect, but cannot ping/route to remote VPN computers

Setup: L2TP VPN Server on a Windows Server 2008 machine which is behind a router, which is behind a modem/router. Modem/Router (IP: 192.168.2.1, Subnet: 255.255.255.0, DHCP serves 192.168.2.2 to ...
3
votes
1answer
184 views

Unable to access NTPD server except on loopback address Centos 6

I can only get results from: ntpq -p localhost or ntpq -p 127.0.0.1 If, from the same server, I try it as either the external IP address or domain name then it times out with no response. ntpq -p ...
0
votes
1answer
53 views

route client by specific query?

myweb.com has external ip. I have a debian server running BIND9, it contain some clients, I created the zone myweb.com and I created A record to localhost.it's ok, but I would know if I can point ...
0
votes
2answers
680 views

How to disable access to DNS server from internet, leaving intranet intact? Using iptables

I have to manage one server with Open DNS service on. Recently, it was heavily abused for ddos dns amplification attacks by unknown internet attackers. This DNS service is used by some localhost ...
1
vote
2answers
356 views

iptables drop negative DNS responses

How to drop incoming negative DNS responses in Linux? (I want a timeout instead) I'm thinking of creating an iptables rule: iptables -I INPUT -p udp --sport 53 -m u32 ... From wireshark: 000E ...
5
votes
1answer
1k views

iptables: building a rule set against abuse for DNS amplification attacks

I have been working on building a rule set to detect and block a DNS amplification attack. I got stuck and am hoping to find help here. I'll post here what I have (bash scripting, the portions that ...
0
votes
2answers
293 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
1
vote
1answer
350 views

Can IP tables allow specific DNS queries based on domain name?

I have iptables blocking all UDP traffic at the moment, however I want to allow only certain DNS queries to get through. Let's use google.com as an example. I am trying to use string matching to ...
0
votes
1answer
296 views

iptables blocking ability to ping/reach domain names

I'm trying to set up some firewall rules for allowing SSH, incoming ping, munin, and MySQL between one server and another (all those services are working fine with my rules), but when I apply the ...
2
votes
1answer
251 views

ipvsadm lists a few hosts by IP only, rest by name

We use keepalived to manage our Linux Virtual Server (LVS) load balancer. The LVS VIPs are setup to use a FWMARK as configured in iptables. virtual_server fwmark 300000 { delay_loop 10 ...
2
votes
3answers
259 views

how to forward IP request to a specific port

I have 2 servers the first (SRV01) is running Bind and other web app the second (SRV02) is running 2 server Minecraft (^^) in Bind I have 2 A recording for the 2 server MC s1.domain.tld A ...
1
vote
1answer
246 views

How to allow a single domain name with iptables

I am looking for a way to make iptables only accept requests for my domain name and reject the others. Lately I misconfigured my apache proxy, it is now fixed, but I keep receiving a load of requests ...
2
votes
1answer
529 views

Using LVS (Linux Virtual Server) for doing DNS HA

I have been trying to create an LVS DNS HA using CentOS 6.x: Piranha GUI to configure the DNS Pulse is the HA heart of CentOS LB IPTables to configure marks on the packets since DNS uses TCP and UDP ...
1
vote
1answer
81 views

How to get the average packet rate per ip for a port?

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how? I'd like to limit new ips to the average inbound ...
2
votes
2answers
938 views

IPtables: is there a minimum UDP packet size for a DNS lookup?

IPtables for a virtual dedicated server. I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup? Nmap sends 0-byte UDP packets (source : ...
2
votes
1answer
1k views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
0
votes
2answers
387 views

Redirect to port based on requested (sub)domain (1 IP, non-HTTP request) [duplicate]

Possible Duplicate: How to use DNS to redirect domain to specific port on my server So I've been trying to figure out how to redirect a subdomain to a specific port. Let's assume the ...
-1
votes
1answer
767 views

How to set up DNS filtering for specific query types?

I'm running my own authoritative DNS server for my own domains, and I've been dealing with an ongoing problem of DNS amplification attacks using the ANY query type. Considering the world should never ...
0
votes
1answer
261 views

Netfilter/iptables - Accept connections from an DNS CNAME

So I'm trying to accept connections on port 80 only from those IPs whose reverse DNS has a CNAME alias like, for example, *.test.mydomain.com: 1.1.1.1 resolves to boo.foo.com and ...
0
votes
1answer
349 views

DNS server filter using iptables in linux

I am trying to use bind9 on debian as a DNS server. It was working until I added iptables firewall. I have tried the following filter but it does not seem to work. Anyone can help? # DNS -A INPUT ...
0
votes
3answers
4k views

Redirecting DNS port to a specific DNS server

I use a ubuntu server as a router for my users on a NAT network. I want to force all users to use a local dns server setup on the network. Even if they use a public DNS server in their client ...
0
votes
1answer
830 views

iptables masquerading / NAT firewall works with IPs, FAILS on SOME connections, esp when Domain Names are involved

Problem Description: One of two gateway ("firewall") systems failed, so I generated an "identical" one on replacement hardware, and found that when I switched one of the internal machines to go ...
1
vote
2answers
2k views

Can't access BIND DNS server behind iptables

This line is in iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT Do I need something more than port 53 ? it replies using telnet, but nslookup gives a ...
2
votes
2answers
57 views

Firewall requests that think you're another host

I'm a bit of a noob so bear with me. I routinely check my logs for fun and I got many (thousands) of these errors: http://pastebin.com/i0iSKDCW The server I'm having problems with is a Burst.net VPS ...
0
votes
1answer
392 views

Windows machine can't resolve DNS names from CentOS named server

Just setup a new Bind/Named DNS server on our CentOS server. I'm using Webmin to do most of the administration. Once I've added some addresses to the zone, the addresses resolve just fine on the ...
1
vote
1answer
344 views

redirection made by iptables take effect even after i removed the rule from the chain

for example i added the following rule to the PREROUTING chain: iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200 (lets say that both of the ip addresses are ...
4
votes
3answers
608 views

Adding a rule in iptables with destination ip that won't resolved to it domain

I'm adding this rule in iptables with the following IP address as destination: iptables -A FOR_FILTER -d 66.235.138.59 -j ACCEPT it added it successfully with the following result: ACCEPT all ...
0
votes
1answer
151 views

Using twice NATTing and dns_Alg

I am trying to use twice nat along with dns_alg to support a framework, and take its measurements. I have a private network 192.168.0.0/24 this network contains www,dns,dhcp etc for its own ...
5
votes
3answers
1k views

Firewall still blocking port 53 despite listing otherwise?

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it: $ iptables --list -v Chain ...
8
votes
5answers
11k views

iptables rules to allow HTTP traffic to one domain only

I need to configure my machine as to allow HTTP traffic to/from serverfault.com only. All other websites, services ports are not accessible. I came up with these iptables rules: #drop everything ...
2
votes
2answers
2k views

iptables blocking DNS

I have unblocked port 53 on my firewall config , but still my firewall is blocking my dns lookup. I know the dns lookup is working because if i change my default INPUT policy to ACCEPT, then the name ...
2
votes
2answers
952 views

Site becomes slow and unresponsive after iptables configuration with appropriate ports open?

Here is the output of an "iptables-save": # Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010 *mangle :PREROUTING ACCEPT [921:116690] :INPUT ACCEPT [921:116690] :FORWARD ACCEPT [0:0] ...
0
votes
1answer
2k views

My iptables script is blocking incoming/outgoing DNS

Here's the iptables script: echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter echo 1 > /proc/sys/net/ipv4/tcp_syncookies echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo 1 > ...
0
votes
2answers
291 views

SOA domain records cannot be retrieved

I'm still having trouble setting up my nameservers. DNS check says the following about my nameserver address: Checking SOA records for domain. Domain server is not answering to UDP requests on ...
0
votes
1answer
44 views

Host 3 sites on one server (port 80) accessed by DNS, but lock 2 of them down to requests from within certain subnets?

If I have 3 domain names: siteA, siteB, and siteC. Lets say all of these sites are stored on the same server, however I want to lock siteB down to only a certain subnet and siteC to a broader subnet. ...
5
votes
2answers
7k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...