Allow dns queries in iptables

Question

iptables

There are two following lines

iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -j ACCEPT

There is a list of current rules:

[email protected]:/home/testr# iptables -nL
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  192.168.1.60         0.0.0.0/0            tcp dpt:22
ACCEPT     tcp  --  192.168.1.67         0.0.0.0/0            tcp dpt:22
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53
ACCEPT     tcp  --  192.168.1.11         0.0.0.0/0            tcp dpt:443
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            192.168.1.60         tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp spt:22
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443

There is a ping from which I understand that dns is not working, but I don’t understand why.

[email protected]:/etc/network/if-up.d# ping ya.ru
ping: unknown host ya.ru

You need to find out why the rule is not processed, although it is syntactically correct, or find out the similar rule used from your configurations. Thanks in advance.

Answer 1

Sorry, I didn't understand right away.
I will leave here the solution and explanation, if for someone it is also not obvious.
It will be correct like this:

iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 --dport 1024:65535 -j ACCEPT

Because the dns request from the client to the server goes to port 53, the response from the server to the client from port 53, but returns to the client on one of the ports in the range 1024:65535.

Answer 2

iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT

Answer 3

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT