From: Rick Malt <ric@globesoft.net>
To: netfilter@lists.netfilter.org
Subject: iptables blocks dns lookups
Date: Sat, 13 Sep 2003 14:15:23 +0307 [thread overview]
Message-ID: <3F62FAA3.6010101@globesoft.net> (raw)
When I use the High-Security option of redhat-config-securitylevel the
clients have no response when they
run nslookup -sil <some-internet-domain.net> . Even fetchmail dies with
nslookup errors.
but local zone lookups r working properly.
I can also ssh to this box.
I tried to insert a few iptables rules to allow queries on port 53 with
proto udp. but still not working. the clients r able to browse the net
without any problems.
How do i allow dns to the clients
my internet device is ppp0 and the lan device is eth0.
The current rules are ....
--------------------
# Generated by iptables-save v1.2.7a on Thu Sep 11 12:36:22 2003
*mangle
:PREROUTING ACCEPT [374:40132]
:INPUT ACCEPT [370:39959]
:FORWARD ACCEPT [4:173]
:OUTPUT ACCEPT [293:45077]
:POSTROUTING ACCEPT [297:45250]
COMMIT
# Completed on Thu Sep 11 12:36:22 2003
# Generated by iptables-save v1.2.7a on Thu Sep 11 12:36:22 2003
*nat
:PREROUTING ACCEPT [8:611]
:POSTROUTING ACCEPT [19:1118]
:OUTPUT ACCEPT [19:1118]
COMMIT
# Completed on Thu Sep 11 12:36:22 2003
# Generated by iptables-save v1.2.7a on Thu Sep 11 12:36:22 2003
*filter
:INPUT ACCEPT [8:663]
:FORWARD ACCEPT [2:88]
:OUTPUT ACCEPT [293:45077]
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s 127.0.0.1 -p udp -m udp --sport 53 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s 192.168.100.0/24 -p udp -m udp --sport 53 -j
ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j
REJECT --reject-with icmp-port-unreachable
-A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT --reject-with
icmp-port-unreachable
COMMIT
# Completed on Thu Sep 11 12:36:22 2003
---------
Thanks in advance
reply other threads:[~2003-09-13 11:08 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3F62FAA3.6010101@globesoft.net \
--to=ric@globesoft.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.