Firewall problem

Gary.D

Gary.D

Hoodie
Messages
2,499
Name
Gary Derbridge
Edit My Images
Yes
I'm trying to set-up a DNS server on my own (Debian Linux) server.

It works, providing I turn off the firewall - not an option!

So, I need a rule that allows DNS.

Does anyone know what that is?

Web searches haven't provided an answer.

Thanks

Gary.
 
DNS servers listen on port 53 (TCP and UCP) as neil says, therefore your linux box needs to accept connections on this port from any machines you want it to provide DNS for. You talk about turning off the firewall without stating whether that is a firewall on the linux machine or on your router or something else.

What are you trying to acheive with this?
 
OK, I turned off the Linux machine firewall (for a very short period of time) and checked via a web site that searches for your DNS server when you give it the address.

When the Linux firewall is in place, it doesn't work; if I turn the firewall off, it does.

I've tried the following without success:

DNS/ACCEPT fw net udp 53
DNS/ACCEPT net fw udp 53

ACCEPT fw net udp 53
ACCEPT net fw udp 53

I understand, in the main, DNS uses udp and only uses tcp when data strings are long.

Right now, I can't work out why these rules are not working.

Shorewall also provides a macro for DNS, but I don't know how to get that working.

Any help would be appreciated.
 
your best friend on this is probably google, that's where I sort out most of my computer issues
 
I don't run BIND and it's many years since I managed a server running it so I can't remember what (if anything) it logs about incoming connections into /var/log. Assuming you have logging enabled, check the log file to see what requests are being made with the firewall disabled and with it enabled but port 53 open. If in one case it is getting a request and in the other it isn't it suggests the port isn't really open or the syn/ack part is failing (maybe your server isn't allowed to talk out even though it accepts connections? I'm guessing wildly at this point.)

Alternatively, ethereal is always your friend in diagnosing connectivity problems.
 
You must log in or register to reply here.
Back
Top