iptables and DNS

[Ramin Alidousti]

On Tue, Jun 04, 2002 at 11:35:39AM -0700, Brian Ugie wrote:

> Actually iptables-save will resolve to ip when it saves regardless of
> weather you created the chain with IPs or hostnames. I guess you would
> never know which way I did it but I assure you that I am entering the
> IPs when I create the chains.
> 
>   I feel that you are all missing what the problem is. Let me see if I
> can explain it better.
> 
> The example server is NS2.pzs.com and has an ip address of 10.1.1.13
> 
> The DNS record for NS2.pzs.com is 66.126.189.37
> 
> A firewall appliance sits in front of the server and mapps the public
> address to the private address. The firewall will only allow port 53
> /udp/tcp traffic in. 
> 
> Now, this works fine with no iptable rules but once I add, say
> 
> iptables -A INPUT -d 10.1.1.13 -p tcp --dport 53 -j ACCEPT
> iptables -A INPUT -d 10.1.1.13 -p udp --dport 53 -j ACCEPT
> iptables -P INPUT  DROP

Is NS2 the same as the firewall? In other words, the rule above
says: dns packets destined for 10.1.1.13 are allowed to enter
the firewall host. Is this what you want?

> DNS will nolonger respond on NS2. But if I go into NS1 and change the

What is NS1? What is your network topology?

> NS2 record so that is resolves to 10.1.1.13, the above rules will work.

I believe that you need to revisit your rule set. But a general "iptables"
rule is that when you're writing rules, do not use dns/host names for the
"-d" and "-s" switches.

Ramin

> --Brian