-2

This is a unique problem related to DNS queries(tcp/udp 53) even with correct UFW/iptables rules and does not relate to /etc/resolv.conf

I can ping google DNS 8.8.8.8 but cannot resolve google.com after turning on the host ufw. Tried searching everywhere and updated ufw and iptables accordingly to allow DNS queries and allow established connection.

My numbered ufw status related to DNS is

Screenshot UFW rules

Stateful matching iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Note: vmnet 1/192.168.191.1/24, 192.168.191.130(guest), eno4 Host public interface.

The strange thing is when I turn off the host ufw, everything works perfectly on guests side. However, I am able to ping any IP addresses even after turning on the firewall.

sudo ufw status numbered | grep 53

FAILED TCPDUMP on UDP/TCP 53 only after pinging google.com via 8.8.8.8

Screenshot (UFW on host)

Note: UFW disabled on guest

New contributor
Rabinpro is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • 1
    This question appears to be off topic. Home and end user computing questions can be asked on Super User. – Michael Hampton Jun 10 at 11:52
1

After a lot of help from serverfault.com :P and an encouragement boost from Michael Hampton, I finally solved the missed ack flags for DNS queries while everything else worked perfectly.

The real problem was: -systemd-resolved somehow did not allow DNS queries from any other IPs except 127.0.0.1 after turning on UFW

The solution is to mangle every output from the guest VM by setting mark to 2

iptables -t mangle -A OUTPUT ! -s 192.168.191.130-j MARK --set-mark 2

where 192.168.191.130 is the cluster where you would not want to block UDP from.

CHEERS!!

New contributor
Rabinpro is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Rabinpro is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.