Comments on: Linux Iptables block or open DNS / bind service port 53 http://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html This is a Linux sys admin journal by Vivek about sys admin work, Linux tips & tricks, hacks, news and more. Fri, 10 Feb 2012 20:37:43 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Trickyhttp://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-160681 Tricky Wed, 03 Nov 2010 06:37:49 +0000 http://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-160681 For pure and simple DNS client (not hosting DNS server and so on), I scripted it as follows: <code>for dnsserverip in `grep nameserver /etc/resolv.conf | sed 's/.* //'` ; do /usr/sbin/iptables -A INPUT -p udp --dport 53 -s $dnsserverip -m state --state NEW -j ACCEPT /usr/sbin/iptables -A INPUT -p tcp --dport 53 -s $dnsserverip -m state --state NEW -j ACCEPT done</code> I also have separate lines in my generic iptables script globally allowing "ESTABLISHED,RELATED", negating the need for adding these parameters elsewhere. For pure and simple DNS client (not hosting DNS server and so on), I scripted it as follows:
for dnsserverip in `grep nameserver /etc/resolv.conf | sed 's/.* //'` ; do
/usr/sbin/iptables -A INPUT -p udp --dport 53 -s $dnsserverip -m state --state NEW -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 53 -s $dnsserverip -m state --state NEW -j ACCEPT
done

I also have separate lines in my generic iptables script globally allowing “ESTABLISHED,RELATED”, negating the need for adding these parameters elsewhere.

]]> By: Crisuhttp://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-153328 Crisu Thu, 04 Feb 2010 17:44:58 +0000 http://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-153328 Hi guys, don't know it is right place to post it but i'd like to ask does any of you know how to change that port 53 to port 25. Our profesors in scool gave us something like this to solve. Hi guys, don’t know it is right place to post it but i’d like to ask does any of you know how to change that port 53 to port 25. Our profesors in scool gave us something like this to solve.

]]> By: simshttp://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-147972 sims Fri, 03 Apr 2009 15:06:01 +0000 http://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-147972 Also say your running a name server and you need to communicate with any name servers: <code> IPADDR=xxx.xxx.xxx.xxx UNPRIVPORTS="1024:65535" iptables -A OUTPUT -p udp -s $IPADDR --sport $UNPRIVPORTS -d 0/0 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p udp -s 0/0 --sport 53 -d $IPADDR --dport $UNPRIVPORTS -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -s $IPADDR --sport $UNPRIVPORTS -d 0/0 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp -s 0/0 --sport 53 -d $IPADDR --dport $UNPRIVPORTS -m state --state ESTABLISHED -j ACCEPT </code> Also say your running a name server and you need to communicate with any name servers:


IPADDR=xxx.xxx.xxx.xxx
UNPRIVPORTS="1024:65535"
iptables -A OUTPUT -p udp -s $IPADDR --sport $UNPRIVPORTS -d 0/0 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s 0/0 --sport 53 -d $IPADDR --dport $UNPRIVPORTS -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $IPADDR --sport $UNPRIVPORTS -d 0/0 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 53 -d $IPADDR --dport $UNPRIVPORTS -m state --state ESTABLISHED -j ACCEPT

]]> By: simshttp://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-147971 sims Fri, 03 Apr 2009 14:27:44 +0000 http://www.cyberciti.biz/tips/linux-iptables-12-how-to-block-or-open-dnsbind-service-port-53.html#comment-147971 Hey buddy, check out this line in your how to: <code>iptables -A OUTPUT-p</code> Poor copy and pasters Hey buddy,

check out this line in your how to:

iptables -A OUTPUT-p

Poor copy and pasters

]]>