iptables - redirect DNS queries

Question

I already have the following iptables rules applied in order to masq all of the wlan1 traffic through wlan0.

*filter
:INPUT ACCEPT [48:6144]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [47:6078]
-A INPUT -i wlan1 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i wlan1 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i wlan1 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i wlan1 -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -d 10.42.0.0/24 -o wlan1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.42.0.0/24 -i wlan1 -j ACCEPT
-A FORWARD -i wlan1 -o wlan1 -j ACCEPT
-A FORWARD -o wlan1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i wlan1 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Tue Mar  3 00:54:14 2015
# Generated by iptables-save v1.4.21 on Tue Mar  3 00:54:14 2015
*nat
:PREROUTING ACCEPT [1:66]
:INPUT ACCEPT [1:66]
:OUTPUT ACCEPT [10:651]
:POSTROUTING ACCEPT [10:651]
-A POSTROUTING -s 10.42.0.0/24 ! -d 10.42.0.0/24 -j MASQUERADE
COMMIT

What i'm trying to achieve is redirecting all of the DNS queries form input interface wlan1 to some specific ip.

I already tired:

iptables -t nat -A PREROUTING -i wlan1 -p udp --dport 53 -j DNAT --to MYDNSIP:53

and

iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to-destination MYDNSIP:53

But it doesn't seem to work. I would appreciate any help

-- Cheers

Solution

Allright, after a few tries I have finally achieved the goal. The key to the success were two rules below:

-A PREROUTING ! -s 10.42.0.1/32 ! -d 10.42.0.1/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.42.0.1:53
-A PREROUTING ! -s 10.42.0.1/32 ! -d 10.42.0.1/32 -p udp -m udp --dport 53 -j DNAT --to-destination 10.42.0.1:53

I hope that this will help someone

Comments

[heemayl]

The thing is in your question you were only filtering udp packets for DNS but DNS uses both tcp and udp and your answer satisfies that..please select it as the correct answer so that this issue can be marked as solved..