Enabled firewall but DNS still is filtered

[Turgut Kalfaoglu]

Hi. I added an exception rule to the firewall, to allow BOTH TCP and UDP to port 53, from/to all, because I run a DNS server. I enabled 'log dropped packages' and disabled DOS protection. Despite these, I get entries in the logs saying that the destination port 53 has been dropped.

May 26 14:32:32 ns2 kern.warn kernel: DROP IN=eth0 OUT= MAC=a8:5e:45:97:75:c8:08:62:66:d0:bf:c8:08:00 SRC=46.229.168.129 DST=192.168.2.2 LEN=74 TOS=0x00 PREC=0x00 TTL=52 ID=45303 PROTO=UDP SPT=18972 DPT=53 LEN=54
May 26 14:32:32 ns2 kern.warn kernel: DROP IN=eth0 OUT= MAC=a8:5e:45:97:75:c8:08:62:66:d0:bf:c8:08:00 SRC=46.229.168.129 DST=192.168.2.2 LEN=74 TOS=0x00 PREC=0x00 TTL=51 ID=45339 PROTO=UDP SPT=57318 DPT=53 LEN=54​

What do you suggest I do?

Many thanks, -t

 

[Turgut Kalfaoglu]

Btw, I checked the iptables -L -n , and indeed when I insert an exception to the server list, it is NOT reflected to the iptables.

So I just manually added a few entries into /jfss/scripts/services-start like:

/usr/sbin/iptables -I INPUT -p tcp --destination-port 53 -j ACCEPT
/usr/sbin/iptables -I INPUT -p udp --destination-port 53 -j ACCEPT​

But this must be a bug since the GUI changes are not reflected here.

 

[ColinTaylor]

Btw, I checked the iptables -L -n , and indeed when I insert an exception to the server list, it is NOT reflected to the iptables.

It won't show up with that command because Virtual Server / Port Forwarding creates entries in the nat table not the filter table.

Where is the DNS server running, on the router or on a server on the LAN?

 

[Turgut Kalfaoglu]

It won't show up with that command because Virtual Server / Port Forwarding creates entries in the nat table not the filter table.

Where is the DNS server running, on the router or on a server on the LAN?

Many thanks for the feedback.. DNS bind is running on the router actually.
-t

 

[ColinTaylor]

DNS bind is running on the router actually.

I can only assume that the router's WAN IP address is 192.168.2.2 in which case Virtual Server / Port Forwarding is the wrong tool to use. You need to put your iptables rules in firewall-start.