I'm running a router with DNS server and I would like to make sure that everybody in my network is actually using my DNS. What are the necessary iptables (?) to redirect all DNS-related traffic to my local DNS server?

  • So you are setting up a DNS server with recursion enabled ? Before going any further, read this urgently : serverfault.com/questions/634793/… – Xavier Lucas Oct 11 '14 at 15:57
  • This is somewhat of a lost cause. If your users don't want to use your DNS, there are plenty of ways they can tunnel around you. – Andrew B Oct 13 '14 at 13:30

You probably mean a kind of transparent forwarding, something which iptables calls Destination NAT:

ethL=eth0     # internal network NIC
dnsip= # IP of your DNS
iptables -t nat -A PREROUTING -p udp --dport 53 -i $ethL -j DNAT --to $dnsip

However, there are potential problems with this approach to consider:

  • this is a variant of NAT with all the associated costs (pass-through performance, kernel memory &c);
  • this will only work for packets which cross the router - clients who speak to a DNS server on their local IP network will continue to.
  • This is the answer that addresses the actual question: using iptables to force outbound queries onto the local network's DNS server. – Andrew B Oct 13 '14 at 13:32

You'll want to block any outbound DNS traffic from your users except to your local DNS server, so something like this can get you started:

local_network=X.X.X.X/24 # IP address/subnet-mask of local network
dns_server=Y.Y.Y.Y # IP address of DNS server

iptables -A INPUT -s $local_network -d $dns_server -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s $local_network ! -d $dns_server -p udp --dport 53 -j DROP
iptables -A OUTPUT -s $dns_server -d $local_network -p udp --sport 53 -j ACCEPT

If your DNS server is a caching/recursive DNS server, then you'll need to allow it to do external lookups as well:

iptables -A INPUT -d $dns_server -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT -s $dns_server -p udp --dport 53 -j ACCEPT

You need to allow only DNS traffic from you DNS server and deny all other requests

# Allow DNS from your ip

iptables -A INPUT -p udp --dport 53 -s <source IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s <source IP> -j ACCEPT

# Deny all other requests

iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

Check the Answer here Block all incoming DNS requests EXCEPT from IPs x,y,

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.