Arch Linux

graph

Member

Registered: 2010-12-21

Posts: 105

[SOLVED] Problem with Iptables and DNS-resolving

So I'm changing my iptables default policy from ALLOW to DROP, and are tightening up the rules too.
However, I'm having troubles with allowing DNS-queries, while keeping things as locked down as possible.

/etc/resolv.conf

domain home
nameserver 192.168.1.1

Relevant rules:

# Allow HTTP
$CMD -A OUTPUT -o wlan0 -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow HTTPS
$CMD -A OUTPUT -o wlan0 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp --dport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# DNS-related rules
$CMD -A INPUT -i wlan0 -s 192.168.1.1 -p tcp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -s 192.168.1.1 -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
$CMD -A OUTPUT -o wlan0 -d 192.168.1.1 -p tcp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A OUTPUT -o wlan0 -d 192.168.1.1 -p udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

What am I missing here?

Last edited by graph (2012-03-20 18:36:23)

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: [SOLVED] Problem with Iptables and DNS-resolving

I'm assuming you just want to allow that box to surf the net?

This should do it:

# Allow HTTP
$CMD -A OUTPUT -o wlan0 -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp -sport 80 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow HTTPS
$CMD -A OUTPUT -o wlan0 -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# DNS-related rules
$CMD -A INPUT -i wlan0 -s 192.168.1.1 -p udp --sport 53 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$CMD -A OUTPUT -o wlan0 -d 192.168.1.1 -p udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

However, you're sure that nameserver is correct (you're running your own dns server or a router which has that functionality or so)? If not, try adding the actual dns server ip's to your iptables (and to your /etc/resolv.conf).

---

Burninate!

graph

Member

Registered: 2010-12-21

Posts: 105

Re: [SOLVED] Problem with Iptables and DNS-resolving

I'm assuming you just want to allow that box to surf the net?

Yepyep. Sorry for not mentioning that.

192.168.1.1 is my router, and when I'm disabling the firewall, everything is working perfectly. This is with 192.168.1.1 as nameserver in /etc/resolv.conf.

I tried changing my rules to your rules, but I still can't get it to work.

The following is the output while I'm connecting to www.xkcd.com using elinks:

Output of tcpdump -n '(port 80 or 443 or 53)'
without iptables running: pastebin.com
with iptables running: pastebin.com

It seems to me that DNS is working properly, and that iptables is blocking port 80, right?

Last edited by graph (2012-03-20 08:20:44)

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: [SOLVED] Problem with Iptables and DNS-resolving

Dns is fully operational, yes.

I have a feeling it has something to do with the "conntrack" module. Since it's a fairly simple setup you're trying to accomplish; would you mind trying with "state" instead?

# Allow HTTP
$CMD -A OUTPUT -o wlan0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp -sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow HTTPS
$CMD -A OUTPUT -o wlan0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
$CMD -A INPUT -i wlan0 -p tcp --sport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT

# DNS-related rules
$CMD -A INPUT -i wlan0 -s 192.168.1.1 -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$CMD -A OUTPUT -o wlan0 -d 192.168.1.1 -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

---

Burninate!

graph

Member

Registered: 2010-12-21

Posts: 105

Re: [SOLVED] Problem with Iptables and DNS-resolving

So I tried with state, and it worked. Then I tried with conntrack, and all of a sudden it worked too.
I have no idea what changed, but annoyingly it sure does work now.