iptables blocks dns lookups

iptables blocks dns lookups

[Rick Malt]

When I use the High-Security option of redhat-config-securitylevel the 
clients have no response when they
run nslookup -sil <some-internet-domain.net> . Even fetchmail dies with 
nslookup errors.
but local zone lookups r working properly.
I can also ssh to this box.
I tried to insert a few iptables rules to allow queries on port 53 with 
proto udp. but still not working. the clients r able to browse the net 
without any problems.

How do i allow dns to the clients
my internet device is ppp0 and the lan device is eth0.


The current rules are ....
--------------------
# Generated by iptables-save v1.2.7a on Thu Sep 11 12:36:22 2003
*mangle
:PREROUTING ACCEPT [374:40132]
:INPUT ACCEPT [370:39959]
:FORWARD ACCEPT [4:173]
:OUTPUT ACCEPT [293:45077]
:POSTROUTING ACCEPT [297:45250]
COMMIT
# Completed on Thu Sep 11 12:36:22 2003
# Generated by iptables-save v1.2.7a on Thu Sep 11 12:36:22 2003
*nat
:PREROUTING ACCEPT [8:611]
:POSTROUTING ACCEPT [19:1118]
:OUTPUT ACCEPT [19:1118]
COMMIT
# Completed on Thu Sep 11 12:36:22 2003
# Generated by iptables-save v1.2.7a on Thu Sep 11 12:36:22 2003
*filter
:INPUT ACCEPT [8:663]
:FORWARD ACCEPT [2:88]
:OUTPUT ACCEPT [293:45077]
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s 127.0.0.1 -p udp -m udp --sport 53 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -s 192.168.100.0/24 -p udp -m udp --sport 53 -j 
ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j 
REJECT --reject-with icmp-port-unreachable
-A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT --reject-with 
icmp-port-unreachable
COMMIT
# Completed on Thu Sep 11 12:36:22 2003


---------

Thanks in advance