I have a Cisco (877) router acting as the main gateway for a network; it has a DSL connection and performs NAT from the internal network to its external, public IP address.

The router allows SSH access for management, and this has been limited using an access list:

access-list 1 permit <internal network range>

line vty 0 4
    transport input ssh
    access-class 1 in

The router's internal web server isn't enabled, but if it was, I know its access could be limited using the same logic:

ip http access-class 1

Now, the gotcha: this router also acts as a DNS server, forwarding queries to external servers:

ip name-server <ISP DNS 1>
ip name-server <ISP DNS 2>
ip dns server

My problem is: the router is perfectly happy to answer DNS queries when receiving them on its external interface.

How can I block this kind of traffic so that the router only answers DNS queries from the internal network?

!Deny DNS from Public 
 ip access-list extended ACL-IN_FROM-WAN
  remark allow OpenDNS lookups
  permit udp any eq domain
  permit tcp any eq domain
  remark deny all others and log the attempts
  deny   udp any any eq domain log
  deny   tcp any any eq domain log
  permit ip any any

! Apply to WAN interface
 int WAN
  ip access-group ACLIN-TO_WAN in
  • 3
    While in theory this answers the question it would be best if you explained what this is. – Jacob Jun 19 '14 at 6:49
  • 1
    Please feel free to edit your post to make it readable and understandable. – Deer Hunter Jun 19 '14 at 8:25
  • This ACL works, but it causes a problem: it's impossible to perform DNS queries to any other server from inside the network, because the reply can't come back. How can this be avoided? – Massimo Jul 26 '15 at 16:46

Put an ACL on the external interface. Works just the same. Make an ACL, extended or regular, then apply it but on the external interface, allowing only the traffic you want. Regardless of DNS you should have that.

I haven't tried that myself (wouldn't run a DNS on my routers)... but this seems to be what you are looking for:

DNS View Usage Restrictions Based on the Query Source IP Address

A standard IP ACL is a numbered or named set of host IP address-matching rules, with each rule specifying the type of action to be performed if an IP address matches the text string pattern in the rule. The Split DNS feature supports the use of a standard ACL as a view-use restriction based on the query source IP address. In order for a source IP address to match a name list, the IP address must match a rule that explicitly permits a matching pattern but the IP address cannot match any rules that explicitly deny a matching pattern.


  • Ok, so this is not to be handled at the service level (like SSH and HTTP) but at the interface level? – Massimo Feb 26 '14 at 21:05
  • I really don't see any other way. – ETL Feb 26 '14 at 21:14
  • I tried, but there's a problem: I can successfully block incoming UDP/53 packets on the external interface... but then DNS replies from Internet DNS servers are blocked too! – Massimo Feb 26 '14 at 21:31
  • Maybe post your ACL and how you applied it. – ETL Feb 26 '14 at 22:42
  • A deny for UDP/53 packets coming from anywhere, applied as an input ACL to the external interface. Unfortunately, UDP is connectionless, thus the router can't tell if a packet is a new DNS query coming from a complete stranger, or an answer to a query it started iself... – Massimo Feb 26 '14 at 22:59

I would add a comment but I cannot. The answer is to simply add an allow statement for your DNS servers that you use so if you're using Google's then add a permit statement for udp port 53 from above your deny statement.

OR use reflexive ACLs: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html


There's a simpler way to do it with NAT:

ip nat inside source static udp 53 interface GigabitEthernet0/0 53 

(With an 877 I guess your external interface would be Dialer0 or atm0.1 depending on if you use ppp, instead of Gi0/0 - whatever has "ip nat outside" on it)

This should divert all incoming connections, but all connections going out from the inside should have a matching entry in the NAT table and work. This also necessitates that you specify your internal interface as the source lookup interface:

ip domain lookup source-interface Vlan1

(substitute your own internal interface for Vlan1 if you're using something else)

And that should do the trick.


Suppose you have fa0 as WAN

ip access-list extended WAN_ACL_IN
  remark --- These are outgoing DNS queries.
  permit udp any eq domain any gt 1023

  remark --- Permit legitimate business traffic.
  permit tcp any any established
  permit udp any range 1 1023 any gt 1023

  remark --- Deny all other DNS traffic.
  deny   udp any any eq domain
  deny   tcp any any eq domain

  remark --- Explicitly deny all other traffic. 
  deny   ip any any

and you need to apply the acl to your WAN interface

 interface fa0 
   ip access-group WAN_ACL_IN in

If one had an outside interface G0/1 with IP This ACL will block requests specifically coming from outside trying to hit your outside interface, while leaving other forms of DNS traffic unaffected.

 ip access-list extended Outside-In
    deny   udp any host eq domain
    deny   tcp any host eq domain
    permit ip any any
interface GigabitEthernet0/1
 ip access-group Outside-In in
  • Sorry, this is completely wrong. This ACL would also block DNS replies from reaching the router when it (or some machine inside the LAN) performs DNS queries to external servers, effectively blocking DNS resolution. – Massimo May 12 '16 at 18:28
  • Sorry YOU are completely wrong. This is ACL Lists 101. Man, perform your due diligence before you ding somebody. This is exactly the setup I run. I know it works. – user3524983 Mar 11 '17 at 19:17

I solved this problem on my network by giving my clients dns servers in the dhcp pool options, i discovered my isp's DNS servers, then turning off the dns server on the router - no ip dns-server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.