This is a unique problem related to DNS queries(tcp/udp 53) even with correct UFW/iptables rules and does not relate to /etc/resolv.conf

I can ping google DNS but cannot resolve google.com after turning on the host ufw. Tried searching everywhere and updated ufw and iptables accordingly to allow DNS queries and allow established connection.

My numbered ufw status related to DNS is

Screenshot UFW rules

Stateful matching iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Note: vmnet 1/,, eno4 Host public interface.

The strange thing is when I turn off the host ufw, everything works perfectly on guests side. However, I am able to ping any IP addresses even after turning on the firewall.

sudo ufw status numbered | grep 53

FAILED TCPDUMP on UDP/TCP 53 only after pinging google.com via

Screenshot (UFW on host)

Note: UFW disabled on guest

  • 1
    This question appears to be off topic. Home and end user computing questions can be asked on Super User. Commented Jun 10, 2021 at 11:52

1 Answer 1


After a lot of help from serverfault.com :P and an encouragement boost from Michael Hampton, I finally solved the missed ack flags for DNS queries while everything else worked perfectly.

The real problem was: -systemd-resolved somehow did not allow DNS queries from any other IPs except after turning on UFW

The solution is to mangle every output from the guest VM by setting mark to 2

iptables -t mangle -A OUTPUT ! -s MARK --set-mark 2

where is the cluster where you would not want to block UDP from.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .