I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it:

$ iptables --list -v

Chain INPUT (policy DROP 8886 packets, 657K bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    2   122 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 
20738 5600K ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  eth1   any     anywhere             node1.com multiport dports http,smtp 
    0     0 ACCEPT     udp  --  eth1   any     anywhere             ns.node1.com udp dpt:domain 
    0     0 ACCEPT     tcp  --  eth1   any     anywhere             ns.node1.com tcp dpt:domain 
    0     0 ACCEPT     all  --  eth0   any     node2.backend        anywhere            
   21  1260 ACCEPT     all  --  eth0   any     node3.backend        anywhere            
    0     0 ACCEPT     all  --  eth0   any     node4.backend        anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 15804 packets, 26M bytes)
 pkts bytes target     prot opt in     out     source               destination

nmap -sV -p 53 ns.node1.com // From remote server

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2011-02-24 11:44 EST
Interesting ports on ns.node1.com (
53/tcp filtered domain

Nmap finished: 1 IP address (1 host up) scanned in 0.336 seconds

Any ideas?


2 Answers 2


I notice that zero packets have actually reached your iptables ACCEPT rules for DNS. I think it is likely that your iptables rules are specifying an inconsistent combination of conditions that never match incoming DNS queries.

In your case, your DNS ACCEPT rules specify that the incoming interface must be eth1, and the destination IP address must resolve to ns.node1.com. You should check whether incoming DNS queries to ns.node1.com can ever arrive over the eth1 network interface.

Another possibility is that you have another packet filter somewhere between your test client and your server that is blocking DNS packets.

  • Thanks, I will look into this. The port unblocks when I stop iptables, which rules out a packet filter above my server causing the problem.
    – Tom
    Feb 25, 2011 at 1:46
  • After removing all firewall rules except iptables -A INPUT -i eth1 -j ACCEPT the port is still blocked. When I stop iptables it's open. Any ideas now?
    – Tom
    Feb 25, 2011 at 2:50
  • @Tom: Clearly, your test packets are not hitting the ACCEPT rule, otherwise the port would not be blocked. The most likely conclusion is that your test packets are not arriving on eth1. Are you certain that eth1 is where they should be arriving? Feb 25, 2011 at 16:22
  • I'm not sure, but I'll explain my setup - eth0 has the private IP and eth1 has the main IP, eth1:0 is the nameserver (and the desired destination for the packets) and eth1:1 is for nginx. My other 2 servers have identical interfaces and interface aliases. The only difference I can think of is eth1:0 on the other 2 servers are for slave nameservers and eth1:0 on this server is for the master nameserver. Does that provide any insight? Appreciate your help--this is really killing me.
    – Tom
    Feb 25, 2011 at 17:29
  • I should mention, I've always had these standard rules in the bash script before and after the rules to control services: iptables -F; iptables -Z; iptables -A INPUT -i lo -j ACCEPT; iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; ## rules to control services here ## iptables -P OUTPUT ACCEPT; iptables -P INPUT DROP; iptables -P FORWARD DROP;
    – Tom
    Feb 25, 2011 at 17:35

Likely to tcp port is blocked by another firewall. Use tcpdump/Wireshark to debug problem.

From me:

nmap -sV -p 53 x.x.x.x

Starting Nmap 5.00 ( http://nmap.org ) at 2011-02-25 02:32 YEKT
Interesting ports on x.x.x.x:
53/tcp open  domain  ISC BIND Not available
  • 1
    When I stop iptables the port becomes open.
    – Tom
    Feb 25, 2011 at 1:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .