nat and dns

Nick Drage nickd at
Thu Sep 23 12:34:28 CEST 2004

On Thu, Sep 23, 2004 at 11:00:33AM +0200, Raphael Jacquot wrote:
> hi,
> I have a setup that looks like :
>  _____                                ____
> [     ]                [    ]
> [ DNS ]------------------------------[ FW ]----
> [_____]       [____] (isp)
> and I want the DNS to answer to queries from the outside
> what's the proper way of doing this ?

I'm presuming that you want to answer queries from everywhere, rather
than just from specific hosts, in which case:

iptables -t nat -A PREROUTING --destination $EXTERNAL_IP -p udp --dport
53 -j DNAT --to-destination

iptables -t nat -A PREROUTING --destination $EXTERNAL_IP -p tcp --dport
53 -j DNAT --to-destination

iptables -A FORWARD --destination -p udp --dport 53 -j

iptables -A FORWARD --destination -p tcp --dport 53 -j

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

I'd be interested to hear how you get on by the way, I'm not quite sure
that my iptables rulebases are keeping state on DNS requests correctly.

mors omnia vincit

More information about the netfilter mailing list