I have a Raspberry Pi that is running Bind9 as an authoritative DNS server for a local zone. Every other DNS requests are forwarded to a public DNS server. So Bind9 is listening on port 53 at address

Now I want to install Unbound on this Raspberry Pi to provide "DNS over TLS". Because you can't have two different resolvers listening on the same port (53), I thought that I could solve this with a second IP address and port forwarding.

So I configured unbound to listen at DNS queries to this port and address are answered correctly. Over IPtables I installed the following rules:

iptables -t nat -A PREROUTING -p udp --dst --dport 53 -j REDIRECT --to-ports 1053
iptables -t nat -A PREROUTING -p tcp --dst --dport 53 -j REDIRECT --to-ports 1053

Now DNS queries to and port 53 are not answered because of a timeout at the client side.

With IPtables I can determine that the rules are applied correctly but I didn't get an answer. Why?

  • Why not simply do DNS over TLS in BIND? Jun 7, 2019 at 23:54
  • Don't want to do "DNS over TLS" for all clients on the network and bind9 is only able to do it with stunnel.
    – idlmn89
    Jun 8, 2019 at 0:01

1 Answer 1


I solved this: In the case I described above, simple port forwarding isn't enough. The following does the trick:

iptables -t nat -A PREROUTING -p udp --dport 53 --dst -j DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dport 53 --dst -j DNAT --to-destination

Maybe there are other solutions but this is what works fine for me.

  • This is a good answer! Jun 8, 2019 at 3:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.