Block outgoing DNS via iptables on a linux router

Question

I have a small network with a linux router running Debian 9, I'm having some difficulty with preventing the devices inside the network from querying external DNS services. I would like to REJECT queries made for external DNS services and only accept queries to the Unbound service running on the router.

Here are my rules:

#!/bin/bash

WAN=ppp0
LAN=enp2s0
VLAN10=enp2s0.10
VLAN20=enp2s0.20
VLAN30=enp2s0.30

LAN_NET=192.168.1.0/24
VLAN10_NET=192.168.10.0/24
VLAN20_NET=192.168.20.0/24
VLAN30_NET=192.168.30.0/24

echo "Flushing rules"
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

echo "Allow loopback"
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

echo "Drop invalid states"
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP

echo "Allow established and related packets"
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

echo "Allow echo 'ping' replies"
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT

echo "Port forwarding 4242 to 22 on router"
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 4242 -j DNAT --to-destination 192.168.1.1:22
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

echo "Allow SSH from local Ethernet"
#iptables -A INPUT -i $LAN -s $LAN_NET -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

echo "Allow DHCP"
iptables -I INPUT -i $LAN -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN10 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN20 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN30 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT

echo "Allow DNS (UDP and TCP for large replies)"
iptables -A INPUT -i $LAN -s $LAN_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $LAN -s $LAN_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN20 -s $VLAN20_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN20 -s $VLAN20_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN30 -s $VLAN30_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN30 -s $VLAN30_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT

echo "Block external DNS"
iptables -I OUTPUT -p udp --dport 53 -j REJECT
iptables -I OUTPUT -p tcp --dport 53 -j REJECT

echo "Block external DoT"
iptables -I OUTPUT -p tcp --dport 853 -j REJECT

echo "Enable NAT"
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
iptables -A FORWARD -o $WAN -i $LAN -s $LAN_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN10 -s $VLAN10_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN20 -s $VLAN20_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN30 -s $VLAN30_NET -m conntrack --ctstate NEW -j ACCEPT

echo "Enable TCP MSS clamping"
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

echo "Do not reply with Destination Unreachable messages"
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j DROP

echo "Log all dropped packets"
iptables -A INPUT -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPIN>'
iptables -A OUTPUT -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPOUT>'
iptables -A FORWARD -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPFWD>'

The part where I tried to block external queries:

echo "Block external DNS"
iptables -I OUTPUT -p udp --dport 53 -j REJECT
iptables -I OUTPUT -p tcp --dport 53 -j REJECT

echo "Block external DoT"
iptables -I OUTPUT -p tcp --dport 853 -j REJECT

Thanks in advance for any help or input!

Answer 1

Try to add:

iptables -A FORWARD -o $WAN -p tcp --dport 53 -j REJECT
iptables -A FORWARD -o $WAN -p udp --dport 53 -j REJECT

The problem is you are blocking the connection to port 53 of your LinuxBox/Firewall and not the conexion to pass through of your LinuxBox/Firewall.

You need check how tables works in iptables.