I am having problem opening port 53 on my centos machine, for DNS configuration.

Here is my iptables config

-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

When I ran a nmap scan of the machine only port 80 showed up as open on it. Am I missing anything?


Full iptable


-A INPUT -p udp -m state --state NEW,ESTABLISHED -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT -reject-with icmp-host-prohibited
-A FORWARD -j REJECT -reject-with icmp-host-prohibited
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
  • What was the nmap command line you used? – Hauke Laging May 17 '13 at 14:38
  • nmap – user1817081 May 17 '13 at 14:39
  • 1
    maybe you have a DROP before. -A add these rules at the end of chains. – Laurentiu Roescu May 17 '13 at 14:39
  • An iptables --list would be handy to see. You'll also want to disable the firewall in system-config-firewall-tui (or in your gui), so that you can manually set it with iptables commands, otherwise, it will re-write your iptables if you use that. Bonus tip, in centos (at least) you can do a service iptables save when you're done, so the changes stick for the next reboot. – dougBTV May 17 '13 at 14:43
  • 2
    You allow UDP only but nmap does not test UDP ports by default. You need this: nmap -sU -p 53 $host – Hauke Laging May 17 '13 at 14:54

Your semantics are reversed.

The rules you posted permit outgoing DNS connections to a remote DNS server, not incoming connections to a local DNS server.

To permit connections to your local DNS server, reverse the INPUT and OUTPUT rules:

-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 53 -j ACCEPT

(And please take a few minutes at some point to revise your firewall to be stateful.)

  • 2
    You may also want to optionally allow TCP connections if doing AFXR or other DNS transfers. – jeffatrackaid May 17 '13 at 15:50
  • Don't block TCP queries on DNS server. Some responses, like www.google.com will not fit in UDP packet and need to be repeated by TCP. TCP is not only for DNS transfers - it is required for normal queries. – Tometzky May 19 '13 at 20:00

Use -I instead of -A .

As you have a DNS server listening then it will be listening on port 53 so the input rule should be

-I INPUT -p udp -m udp --dport 53 -j ACCEPT

Are you sure the DNS server is actively running? Even if you have the port open, the service needs to be active. You can verify what is listening locally by running a netstat command. Also, have you tried completely turning off the firewall momentarily just to see what shows up?

  • Yes, I am sure that the DNS is running. If i turned of the iptables, and run nmap on my other machine the port is shown as open. – user1817081 May 17 '13 at 14:38
  • Can you post your full iptables config? – Eric May 17 '13 at 14:40
  • post update see above – user1817081 May 17 '13 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.