DNS in iptables?

[virtualpaul]

Hi,

I am having problem with my DNS server when using this iptables config. Any one can suggest a solution?

*filter

# Samba
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT

# SYN Flood Protection
-A INPUT -p tcp --syn -m limit --limit 5/second -j ACCEPT

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT

# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allows SSH connections
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

# My webmin custom port
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT

#POP mail <br>
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT --syn

#SMTP Traffic <br>
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT --syn

#HTTP <br>
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn

#HTTPS <br>
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT --syn

# IMAP mail services <br>
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT --syn

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# DNS
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT --syn
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp -s 0/0 -d 0/0 --sport 53 -j ACCEPT

# Localhost traffic <br>
-A INPUT -i lo -j ACCEPT

# log iptables denied calls (access via 'dmesg' command)
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy:
-A INPUT -j REJECT
-A FORWARD -j DROP

# The below commits the rules to production for iptables to execute <br>
COMMIT

[Lazydog]

I would change your complete firewall rules. From what I see you are mixing STATEFUL with CONNECTION and I would not do this.

To your original question on DNS

Change

# DNS
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT --syn
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp -s 0/0 -d 0/0 --sport 53 -j ACCEPT

to

# DNS
-A INPUT -m state --state NEW --dport 53 -j ACCEPT

Since DNS uses both TCP and UDP there is no real reason to make more then one statement in your rules.

I would move

# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

To the top of your rules lists. Remember rules are read and executed top down.

Then I would add the -m state --state NEW to all your rules and remove the --syn from the end of any rule that has it as

# SYN Flood Protection
-A INPUT -p tcp --syn -m limit --limit 5/second -j ACCEPT

takes care of your syn.

[virtualpaul]

Hi Robert,

Thanks a lot for your help.

I did all the modifications you suggested but the new DNS rule seems to generate this error:

iptables-restore v1.4.2: Unknown arg `(null)'

Also I was not sure if the two last rules need the "-m state --state NEW" you suggested since they are the catch all the rest rules:

# log iptables denied calls (access via 'dmesg' command)
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy:
-A INPUT -j REJECT
-A FORWARD -j DROP

[Lazydog]

Is the above your complete rule set?

Try the following:

#!/bin/bash
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --syn -m limit --limit 5/second -j ACCEPT
iptables -A INPUT -m state --state NEW --dport 53 -j ACCEPT
iptables -A INPUT -m state --state NEW -p udp -m udp --dport 137 -j ACCEPT
iptables -A INPUT -m state --state NEW -p udp -m udp --dport 138 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 10000 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

[virtualpaul]

Hi Robert,

I am getting this error if I don't comment the line of the DNS filter:

iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.

All the rest seemed to be accepted by iptables.

[Lazydog]

You do need the tcp/udp in the rules for Stateful tracking. Sorry about that.
The following should work:

#!/bin/bash
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --syn -m limit --limit 5/second -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
iptables -A INPUT -m state --state NEW -p udp -m udp --dport 137 -j ACCEPT
iptables -A INPUT -m state --state NEW -p udp -m udp --dport 138 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 10000 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

What the above does is setup your firewall to be STATEFUL.

[virtualpaul]

Hi Robert,

Great, it works now!

Thanks a lot for your help.

[Lazydog]

Glad I was able to help you.