DNS

DNS

[Mattia Martinello]

Hi all

I wish to open DNS connections and redirect it from the gateway and the 
server on the DMZ.
I tried these rules:

iptables -t nat -A PREROUTING -p tcp -i ppp0 -d [public IP] --dport 53 
-j DNAT --to [private IP]:53
iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j ACCEPT

iptables -t nat -A PREROUTING -p udp -i ppp0 -d [public IP] --dport 53 
-j DNAT --to [private IP]:53
iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j ACCEPT

But if I try to query my DNS server from the Internet my query goes in 
timeout.
The connections between [private IP] and the Internet are allowed (all 
other services work good without any problem, the only service that gets 
me some problems is DNS).

What have I to open to allow DNS connections from the gateway and the DMZ?

Thank you very much
Bye
Mattia

unsubscribe telefon jackfritt@boh.de

[Jörg Esser]

Re: DNS

[Peter Johnson]

I am experiencing a similar sort of thing, I am using the 2.4.20 kernel.

I put logging everywhere and also tcpdumped my interfaces and what I
found was that as soon at the PREROUTING DNAT rule was reached the
packet disappeared. It was not forwarded and certainly didn't reach the
internal server.

My rules are (I am trying HTTP, "dot" is my public interface)

$IPTABLES -t nat -A PREROUTING -i dot -p tcp --dport 80 -j DNAT --to
192.168.1.1:80

and

$IPTABLES -t filter -A FORWARD -i dot -o eth1 -p tcp --dport 80 -j
ACCEPT

I look forward to hearing any advice to further debug this situation or
if the solution is obvious then please let me (us) know.

btw. I am forwarding local traffic out successfully.


Regards,

Peter Johnson

On Mon, 2003-01-13 at 22:52, Mattia Martinello wrote:
> Hi all
> 
> I wish to open DNS connections and redirect it from the gateway and the 
> server on the DMZ.
> I tried these rules:
> 
> iptables -t nat -A PREROUTING -p tcp -i ppp0 -d [public IP] --dport 53 
> -j DNAT --to [private IP]:53
> iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j ACCEPT
> 
> iptables -t nat -A PREROUTING -p udp -i ppp0 -d [public IP] --dport 53 
> -j DNAT --to [private IP]:53
> iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j ACCEPT
> 
> But if I try to query my DNS server from the Internet my query goes in 
> timeout.
> The connections between [private IP] and the Internet are allowed (all 
> other services work good without any problem, the only service that gets 
> me some problems is DNS).
> 
> What have I to open to allow DNS connections from the gateway and the DMZ?
> 
> Thank you very much
> Bye
> Mattia
> 
> 
-- 

Give a man a fish and you feed him for a day. Teach him to use the Net
and he won't bother you for weeks.

Re: DNS

[Joel Newkirk]

On Monday 13 January 2003 06:52 am, Mattia Martinello wrote:
> Hi all
>
> I wish to open DNS connections and redirect it from the gateway and
> the server on the DMZ.
> I tried these rules:
>
> iptables -t nat -A PREROUTING -p tcp -i ppp0 -d [public IP] --dport 53
> -j DNAT --to [private IP]:53
> iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j
> ACCEPT
>
> iptables -t nat -A PREROUTING -p udp -i ppp0 -d [public IP] --dport 53
> -j DNAT --to [private IP]:53
> iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j
> ACCEPT

Do you also have a FORWARD rule ACCEPTing UDP port 53?  It may be a type 
in the mail, but your FORWARD rules are both for TCP here...

BTW, the :53 in the DNAT destination is unnecessary, it will keep the 
same port unless you specify something different.  Not an issue,  just a 
comment. :^)

j

> But if I try to query my DNS server from the Internet my query goes in
> timeout.
> The connections between [private IP] and the Internet are allowed (all
> other services work good without any problem, the only service that
> gets me some problems is DNS).
>
> What have I to open to allow DNS connections from the gateway and the
> DMZ?
>
> Thank you very much
> Bye
> Mattia

unsubscribe telefon jackfritt@boh.de

[Jörg Esser]

Re: DNS

[Tarek W.]

ur second forward rule matches tcp conns when it should match udp.

On Mon, 2003-01-13 at 09:52, Mattia Martinello wrote:
> Hi all
> 
> I wish to open DNS connections and redirect it from the gateway and the 
> server on the DMZ.
> I tried these rules:
> 
> iptables -t nat -A PREROUTING -p tcp -i ppp0 -d [public IP] --dport 53 
> -j DNAT --to [private IP]:53
> iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j ACCEPT
> 
> iptables -t nat -A PREROUTING -p udp -i ppp0 -d [public IP] --dport 53 
> -j DNAT --to [private IP]:53
> iptables -A FORWARD -i ppp0 -d [private IP] -p tcp --dport 53 -j ACCEPT
> 
> But if I try to query my DNS server from the Internet my query goes in 
> timeout.
> The connections between [private IP] and the Internet are allowed (all 
> other services work good without any problem, the only service that gets 
> me some problems is DNS).
> 
> What have I to open to allow DNS connections from the gateway and the DMZ?
> 
> Thank you very much
> Bye
> Mattia
> 
>