Block all incoming DNS requests EXCEPT from IPs x,y,

Question

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will.

How do you do this with iptables?

Many thanks.

Solution

This is very simple with iptables:

I'll assume your INPUT chain has no default DROP rule at the end, or you'll have to work around that:

# Allow DNS (53) from <source IP>
iptables -A INPUT -p udp --dport 53 -s <source IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s <source IP> -j ACCEPT

# Deny all other DNS requests
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

Simply remove the two bottom rules if you have a default DROP policy. If you have a default DROP rule at the bottom of your chain, you'll have to insert (-I rulenum) these rules above that rule.

Comments

[Zoredache]

Your DNS server may also have ACL support for setting restrictions based on various criteria.

[gparent]

Edited your answer to add TCP ports, pending review.

[ale]

Awesome.. very very nearly what I want :).. I have a secondary DNS though.. do I need to do something on that server too?

[Kyle Smith]

Approved, but I want to double-check this. I believe TCP is only used for IXFR/AXFR transfers?

[gparent]

I believe it is also used for any packets over a certain size. See wikipedia: "The Transmission Control Protocol (TCP) is used when the response data size exceeds 512 bytes, or for tasks such as zone transfers."

[Kyle Smith]

Looks like I'm wrong! Thanks for pointing this out, @gparent. DNS does a "renegotiation" to TCP for large responses.

[gparent]

Good to know, I wasn't sure of the exact details.

[Kyle Smith]

That's why I contribute here, learn something new every day :-)

[gparent]

@ale: Your secondary DNS probably needs to talk to your primary DNS in addition to the IPs you already specify, but that should be it.