Help with custom iptables

[ajp2k14]

I would like to redirect all DNS calls to another internal IP so client DNS is forced through it, how do I do that? I tried adding iptable rules in /root/firewall-start.sh but I can't get it to work...


Thanks!

 

[Voxel]

I would like to redirect all DNS calls to another internal IP so client DNS is forced through it, how do I do that? I tried adding iptable rules in /root/firewall-start.sh but I can't get it to work...


Thanks!

Check that your script /root/firewall-start.sh is executable. And how do you test that it is working? This script will be called following own NG's logic (I do not know when, but not immediately). Just for test try to run it manually. Then is everything is OK and your rules are working, leave it. FW will call this your script when changing rules (adding your's).

Voxel.

 

[ajp2k14]

Check that your script /root/firewall-start.sh is executable. And how do you test that it is working? This script will be called following own NG's logic (I do not know when, but not immediately). Just for test try to run it manually. Then is everything is OK and your rules are working, leave it. FW will call this your script when changing rules (adding your's).

Voxel.

Thanks, I did try to run it manually and got no errors but it didn't work. I couldn't find a trace of it with iptables --list either...

The command I tried to run was (not sure if it's correct):

iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 192.168.1.2:53;
iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 192.168.1.2:53;
iptables -t nat -A POSTROUTING -j MASQUERADE

Thanks!

 

[ajp2k14]

@Voxel Could it be that the R7800 already redirects DNS to itself?

Chain PREROUTING (policy ACCEPT 1233 packets, 103K bytes)

pkts bytes target prot opt in out source destination
0 0 REDIRECT udp -- br0 * 0.0.0.0/0 !192.168.1.1 udp dpt:53 UNKNOWN match `dnshijack' redir ports 53

 

[ajp2k14]

Never mind, I think I got it working!

For those interested...

iptables -t nat -A PREROUTING ! -s 192.168.1.2/32 ! -d 192.168.1.2/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.1.2:53
iptables -t nat -A PREROUTING ! -s 192.168.1.2/32 ! -d 192.168.1.2/32 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.1.2:53

 

[Voxel]

Never mind, I think I got it working!

For those interested...

iptables -t nat -A PREROUTING ! -s 192.168.1.2/32 ! -d 192.168.1.2/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.1.2:53
iptables -t nat -A PREROUTING ! -s 192.168.1.2/32 ! -d 192.168.1.2/32 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.1.2:53

Congratulations! The most important that you were able to find a solution yourself.

Voxel.

 

[ajp2k14]

Thanks, I might even learn something...