1

I have a small network with a linux router running Debian 9, I'm having some difficulty with preventing the devices inside the network from querying external DNS services. I would like to REJECT queries made for external DNS services and only accept queries to the Unbound service running on the router.

Here are my rules:

#!/bin/bash

WAN=ppp0
LAN=enp2s0
VLAN10=enp2s0.10
VLAN20=enp2s0.20
VLAN30=enp2s0.30

LAN_NET=192.168.1.0/24
VLAN10_NET=192.168.10.0/24
VLAN20_NET=192.168.20.0/24
VLAN30_NET=192.168.30.0/24

echo "Flushing rules"
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

echo "Allow loopback"
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

echo "Drop invalid states"
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP

echo "Allow established and related packets"
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

echo "Allow echo 'ping' replies"
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT

echo "Port forwarding 4242 to 22 on router"
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 4242 -j DNAT --to-destination 192.168.1.1:22
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

echo "Allow SSH from local Ethernet"
#iptables -A INPUT -i $LAN -s $LAN_NET -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

echo "Allow DHCP"
iptables -I INPUT -i $LAN -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN10 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN20 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT -i $VLAN30 -p udp -m udp --dport 67 -m conntrack --ctstate NEW -j ACCEPT

echo "Allow DNS (UDP and TCP for large replies)"
iptables -A INPUT -i $LAN -s $LAN_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $LAN -s $LAN_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN10 -s $VLAN10_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN20 -s $VLAN20_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN20 -s $VLAN20_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN30 -s $VLAN30_NET -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -i $VLAN30 -s $VLAN30_NET -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT

echo "Block external DNS"
iptables -I OUTPUT -p udp --dport 53 -j REJECT
iptables -I OUTPUT -p tcp --dport 53 -j REJECT

echo "Block external DoT"
iptables -I OUTPUT -p tcp --dport 853 -j REJECT

echo "Enable NAT"
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
iptables -A FORWARD -o $WAN -i $LAN -s $LAN_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN10 -s $VLAN10_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN20 -s $VLAN20_NET -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -o $WAN -i $VLAN30 -s $VLAN30_NET -m conntrack --ctstate NEW -j ACCEPT

echo "Enable TCP MSS clamping"
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

echo "Do not reply with Destination Unreachable messages"
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j DROP

echo "Log all dropped packets"
iptables -A INPUT -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPIN>'
iptables -A OUTPUT -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPOUT>'
iptables -A FORWARD -m limit --limit 1/sec -j LOG --log-level debug --log-prefix 'DROPFWD>'

The part where I tried to block external queries:

echo "Block external DNS"
iptables -I OUTPUT -p udp --dport 53 -j REJECT
iptables -I OUTPUT -p tcp --dport 53 -j REJECT

echo "Block external DoT"
iptables -I OUTPUT -p tcp --dport 853 -j REJECT

Thanks in advance for any help or input!

1 Answer 1

3

Try to add:

iptables -A FORWARD -o $WAN -p tcp --dport 53 -j REJECT
iptables -A FORWARD -o $WAN -p udp --dport 53 -j REJECT

The problem is you are blocking the connection to port 53 of your LinuxBox/Firewall and not the conexion to pass through of your LinuxBox/Firewall.

You need check how tables works in iptables.

1
  • This solved it! Thanks for the help! I've manually set a client with 8.8.8.8, and it's getting rejected. The only thing that I can't understand it's why it's not getting logged. But I guess that's another problem!
    – c_clerk
    Apr 24, 2019 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.