1

This line is in iptables

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT

Do I need something more than port 53 ? it replies using telnet, but nslookup gives a timeout.

1
  • If you're planning on running a name server and don't know which ports and which protocols it uses you are heading for an epic fail
    – goo
    Jul 14, 2011 at 21:54

2 Answers 2

2

As mentioned, see https://www.rfc-editor.org/rfc/rfc5966. To properly support DNS, you need to allow port 53 for both TCP and UDP. Failure to do so will result in much higher packet fragmentation, particularly with the introduction of IPv6 and DNSSEC (note that all version of BIND since 9.2 will indicate it supports DNSSEC even if you haven't configured DNSSEC (unless you compile it out)). This particularly sucks when people filter out fragments.

1
  • officially, RFC 5966 only applies to implementors of DNS components, and not to operators, although it does include the caveat that not allowing TCP might cause various breakage.
    – Alnitak
    Jul 14, 2011 at 10:04
2

DNS runs on UDP 53 not tcp 53 change your iptables rule to:

-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
5
  • 3
    Actually, you need both TCP and UDP. UDP for most queries and TCP for any larger amount of data such as a zone transfer.
    – dmourati
    Jul 13, 2011 at 23:34
  • 1
    @dmourati, you only need TCP if you are doing a zone transfers or you have a ridiculously large DNS RR or a GIANT TXT record and a large one at that. for 90% of the use cases all you need is udp 53 and opening ports you don't need is not a great idea.
    – Zypher
    Jul 13, 2011 at 23:45
  • I agree which was why I referred to the zone transfer example. See RFC 5966: tools.ietf.org/html/rfc5966 You should go one step further and configure BIND allow-transfer options.
    – dmourati
    Jul 13, 2011 at 23:49
  • 2
    It's not easy to predict when you'll need to do DNS over TCP, and there are a lot more instances where it's becoming required (stuffing DNSSEC into a UDP packet can get exciting). Advising people who don't know what they're doing to restrict tcp/53 is a recipe for incredibly difficult-to-diagnose DNS resolution problems.
    – womble
    Jul 13, 2011 at 23:52
  • 1
    @Zypher Both UDP and TCP are needed - dmourati is right. ObDisclaimer - I wrote that RFC.
    – Alnitak
    Jul 14, 2011 at 10:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .