1

I'm running my own DNS server on an AWS instance. I've modified my security group to accept UDP and TCP connections on port 53.

However, my server is running on port 8053 so I somehow need to direct those outside requests going to 53 to 8053.

I'm pretty sure I need to update iptables, but can not find out how. So far, the most promising commands are

sudo iptables -t nat -A OUTPUT -o lo -p tcp --dport 53 -j REDIRECT --to-port 8053
sudo iptables -t nat -A OUTPUT -o lo -p udp --dport 53 -j REDIRECT --to-port 8053

sudo iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 53 -j REDIRECT --to-port 8053
sudo iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 8053

Here's what the result looks like:

Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53 redir ports 8053
2    REDIRECT   udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53 redir ports 8053

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
1    REDIRECT   udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53 redir ports 8053
2    REDIRECT   tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53 redir ports 8053

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

However, if I run nmap against this host I get this:

Nmap scan report for xxx.amazonaws.com (x.x.x.x)
Host is up (0.040s latency).
Not shown: 997 filtered ports
PORT   STATE  SERVICE
22/tcp open   ssh
53/tcp closed domain
80/tcp open   http

I know my DNS server is listening on 8053. What's going wrong??

  • Things are working. See my comment below. – Sander Smith Jun 24 at 15:42
2
  1. Your iptables commands are correct.

  2. Check what address is listened with command ss -ulnp 'sport == :8053'. It should be 0.0.0.0, otherwise you need additional rules.

  3. Allow in the iptables input packets to port 8053.

iptables -A INPUT -p tcp --dport 8053 -j ACCEPT
iptables -A INPUT -p upd --dport 8053 -j ACCEPT
  1. Check rule counters with iptables-save -c (prefered way) or iptables -t nat -L -n -v. Counters should being incremented when you make checks.

  2. Use the tcpdump to troubleshoot.

  3. You can use the strace to troubleshoot activity of your app.

2

I would check that traffic is reaching the device in the first instance - fire up an SSH session to the box and run:

sudo tcpdump -i eth0 port 53

if there is no traffic coming in then I'd check your AWS VPC security groups and permit through TCP/UDP 53 in the inbound direction - check both the network and NIC levels

If you do see the traffic then

sudo tcpdump -i lo0 port 8053

If there is no traffic - then it'll be your iptables and we can look into that, if you do see traffic then your DNS server is the issue

1

Try from a client machine in AWS:

$ dig @your_dns_server_ip -p 8053 somehost.somedoomain

0

So it turns out that things were working all along. My DNS server is kind of specialized and testing it properly takes a bit of setup. I incorrectly assumed that things wouldn't work because nmap was reporting that port 53 was closed. However, I didn't realize that it really was kind of closed because nothing was listening on it. Instead, any packets received would simply be redirected.

I did try some of the tests suggested here and found that things looked good. Then I set up a comprehensive test in my complete environment and saw things worked perfectly.

Thanks to everyone who tried to help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.