From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Len L." Subject: RE: Blocking access to UDP port 53 (DNS) - Solution Date: Mon, 11 Aug 2003 12:48:22 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <12CC60849165134FB7DF8570B621F4D51C89CD@mailxserver.euler.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C36030.C207BC00" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C36030.C207BC00 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable OK,=20 I got it. Here is the rule set I tried and had success (b.t.w. The DNS = server is fire walled but is a standalone machine - no forwarding)=20 The answer was to reference DNS requests for port 25 only.=20 iptables -A INPUT --protocol udp --source-port 25 -s 63.143.210.0/24 -j = LOG --log-prefix "XXX LOCAL UDP DNS XXX " iptables -A INPUT --protocol udp --source-port 25 -s 63.143.210.0/24 -j = ACCEPT iptables -A INPUT --protocol udp --source-port 25 -j LOG --log-prefix = "XXX EXTERNAL UDP LOG XXX " iptables -A INPUT --protocol udp --source-port 25 -j ACCEPT iptables -A INPUT -p udp -j LOG --log-prefix "XXX UDP DROP XXX " iptables -A INPUT -p udp -j DROP=20 Also will drop the 25 sport reference on the internal side along with = the logging as a final solution Len Laulainen=20 ------_=_NextPart_001_01C36030.C207BC00 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: Blocking access to UDP port 53 (DNS) - Solution

OK,
I got it. Here is = the rule set I tried and had success (b.t.w. The DNS server is fire = walled but is a standalone machine - no forwarding)

The answer was to = reference DNS requests for port 25 only.
iptables -A INPUT = --protocol udp --source-port 25 -s 63.143.210.0/24 -j LOG --log-prefix = "XXX LOCAL UDP DNS XXX "
iptables -A INPUT --protocol udp --source-port 25 -s 63.143.210.0/24 -j = ACCEPT
iptables -A INPUT --protocol udp --source-port 25 -j LOG --log-prefix = "XXX EXTERNAL UDP LOG XXX "
iptables -A INPUT --protocol udp --source-port 25 -j ACCEPT
iptables -A INPUT -p udp -j LOG --log-prefix "XXX UDP DROP XXX = "
iptables -A INPUT -p udp -j DROP =
Also will drop the 25 sport reference = on the internal side along with the logging as a final solution


Len Laulainen



------_=_NextPart_001_01C36030.C207BC00--