I have an Ubuntu Server 12.04, with two network cards:

  • eth0 is connected to the internet
  • eth1 is connected to a private network (

The server is configured as a gateway and hosts DNS and DHCP fro the private network. Computers in the private network (say with IP address can successfully connect to the internet.

The UFW rules look as follows:

Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
67/udp on eth1             ALLOW       68/udp
53                         ALLOW       Anywhere
22                         ALLOW       Anywhere (v6)
80                         ALLOW       Anywhere (v6)
443                        ALLOW       Anywhere (v6)
67/udp on eth1             ALLOW       68/udp
53                         ALLOW       Anywhere (v6)

Any internet user can query my DNS server. I'd like to block such requests as it poses a security risk. I reset the firewall, allowed access to ports 80, 443, 22 and typed the following to only permit devices on the private network to make DNS requests.

sudo ufw allow in on eth1 to port 53

When type the following on a Windows computer (with ip address in the private network:

nslookup google.com.

I get a response back that looks as follows:

DNS request timed out.
    timeout was 2 seconds.
Server: Unknown

When I reset the firewall and allow access to port 53 from anywhere, everything works again.

sudo ufw allow 53

How does one configure UFW on to

  • block incoming DNS queries from the internet (aka eth0)
  • allow computers in the private network to make dns queries
  • allow the dns server on to forward internal DNS requests to the internet
  • work for both IPv4 and IPv6
  • You route internal and external. traffic through the same interface and IP? – Nils Feb 26 '17 at 18:45

In addition to blocking traffic at the UFW I would also limit connections on your DNS server. Assuming you're using BIND, something simliar to this:

acl internal {;
  # Add other internal networks here
options {
  listen-on {; };
  allow-query { internal; };
| improve this answer | |

Try this

sudo ufw allow from to port 53 proto tcp
sudo ufw allow from to port 53 proto udp

This will allow TCP and UDP DNS (port 53) traffic from your local private network (which I assume is, or in other words, and not anywhere else.

Finally, check to make sure your UFW status (run sudo ufw status) has these lines:

To                         Action      From
--                         ------      ---- 53/tcp        ALLOW 53/udp        ALLOW
| improve this answer | |

For the interface-based ufw rule, the following will block access to port 53 (assuming your dns/bind server is configured on port 53) from any interface that is not eth1:

sudo ufw allow all in on eth1 to any port 53 proto tcp
sudo ufw deny to any port 53 

For configuring bind to forward dns requests, you can use this directive in your named.conf file after all your internally-handled zones:

zone "." {
    type forward;
    forwarders {;
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.