IP Tables and DNS

IP Tables and DNS

[David Doster]

Hi folks,

I'm putting together a recursive DNS resolver for my internal clients.  The resolver has both an internal and an external interface, so it doesn't have to send the outgoing DNS queries through the firewall.  I'm working on the IPTables rules for the external interface, and had a question come up that I wasn't sure about.

Does netfilter/iptables keep up with "connections" in UDP, even though UDP is connectionless?  ie - How does it assure that it only accepts responses from the IP that it sent the query to?  I saw a posting from Jan back about 3 years ago that said that as long as the response came back within ~30 seconds then netfilter would allow the response in.  Is that still the case?  If so, do I need any rules on the external interface other than the rules to allow the outgoing query (tcp and udp) and an "established,related" rule?

Thanks for any help,
Dave Doster

Re: IP Tables and DNS

[Andrew Schulman]

> Does netfilter/iptables keep up with "connections" in UDP, even though UDP is connectionless?

Yes.  ICMP, too.

>  ie - How does it assure that it only accepts responses from the IP that it sent the query to?  I saw a posting from Jan back about 3 years ago that said that as long as the response came back within ~30 seconds then netfilter would allow the response in.  Is that still the case?

Can't remember now exactly how this works... but it's something like that.

>  If so, do I need any rules on the external interface other than the rules to allow the outgoing query (tcp and udp) and an "established,related" rule?

Nope.  "Established" covers direct replies to UDP packets (i.e. DNS requests)
that you've already sent out, so that's probably all you need in this case.
"Related" covers new connections related to the first one, such as FTP data
connections triggered by FTP control traffic.  I don't think there are any
"related" criteria that apply to DNS.

A.

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: IP Tables and DNS

[David Doster]

Cool.  Thanks for the info, Andrew.

Dave


>>> Andrew Schulman <andrex@alumni.utexas.net> 9/11/2008 02:53 PM >>>
> Does netfilter/iptables keep up with "connections" in UDP, even though UDP is connectionless?

Yes.  ICMP, too.

>  ie - How does it assure that it only accepts responses from the IP that it sent the query to?  I saw a posting from Jan back about 3 years ago that said that as long as the response came back within ~30 seconds then netfilter would allow the response in.  Is that still the case?

Can't remember now exactly how this works... but it's something like that.

>  If so, do I need any rules on the external interface other than the rules to allow the outgoing query (tcp and udp) and an "established,related" rule?

Nope.  "Established" covers direct replies to UDP packets (i.e. DNS requests)
that you've already sent out, so that's probably all you need in this case.
"Related" covers new connections related to the first one, such as FTP data
connections triggered by FTP control traffic.  I don't think there are any
"related" criteria that apply to DNS.

A.

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org 
More majordomo info at  http://vger.kernel.org/majordomo-info.html 

--- Scanned by M+ Guardian Messaging Firewall ---

Re: IP Tables and DNS

[Vladislav Kurz]

On Thursday 11 of September 2008, Andrew Schulman wrote:
> >  If so, do I need any rules on the external interface other than the
> > rules to allow the outgoing query (tcp and udp) and an
> > "established,related" rule?
>
> Nope.  "Established" covers direct replies to UDP packets (i.e. DNS
> requests) that you've already sent out, so that's probably all you need in
> this case. "Related" covers new connections related to the first one, such
> as FTP data connections triggered by FTP control traffic.  I don't think
> there are any "related" criteria that apply to DNS.

What about some ICMP (port|host) unreachable packet when you try to query a 
broken DNS server? Isn't that a RELATED packet?

-- 
Regards
        Vladislav Kurz

Re: IP Tables and DNS

[Andrew Schulman]

> > Nope.  "Established" covers direct replies to UDP packets (i.e. DNS
> > requests) that you've already sent out, so that's probably all you need in
> > this case. "Related" covers new connections related to the first one, such
> > as FTP data connections triggered by FTP control traffic.  I don't think
> > there are any "related" criteria that apply to DNS.
> 
> What about some ICMP (port|host) unreachable packet when you try to query a 
> broken DNS server? Isn't that a RELATED packet?

Good point, and that could apply for any type of connection.  I'm not sure if
those are matched by ESTABLISHED or RELATED.  I guess there's no harm in
matching against both.

I just looked at my firewall.  The incoming DNS rule matches only ESTABLISHED,
not RELATED.  It's matched 12,000 times since boot.  Later on there is a generic
RELATED match, but it's only matched 19 times.  So FWIW, it seems to me that
ESTABLISHED covers essentially all you need for DNS replies.

Andrew.

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html