Настройка Iptables?

Question

[Hidevs]

-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m multiport --dports 22,25,53,80,443 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A OUTPUT -p icmp -j DROP

при данной конфигурации клиентские машины не видят dns, если изменить P INPUT ACCEPT или прописать на машине вручную днс сервер (8.8.8.8) все начинает работать.
подскажите что поправить

ubuntu server 16.04

dnsmaq:
listen-address=127.0.0.1
listen-address=192.168.1.1
listen-address=192.168.0.1
dhcp-range=192.168.1.100,192.168.1.130,255.255.255.0,2h
dhcp-range=192.168.0.100,192.168.0.130,255.255.255.0,2h

interfaces:
# The loopback network interface
auto lo enp3s2 enp3s1 enp2s0 dsl-provider
iface lo inet loopback

# LAN
iface enp3s1 inet static
address 192.168.0.1
network 192.168.0.0
netmask 255.255.255.0
broadcast 192.168.0.255
dns-nameservers 8.8.8.8 8.8.4.4

# LAN 2
iface enp3s2 inet static
address 192.168.1.1
network 192.168.1.0
netmask 255.255.255.0
broadcast 192.168.1.255
dns-nameservers 8.8.8.8 8.8.4.4

# WAN
iface enp2s0 inet manual
iface dsl-provider inet ppp
pre-up /bin/ip link set enp2s0 up # line maintained by pppoeconf
provider dsl-provider

pre-up iptables-restore < /etc/iptables.up.rules

iptables:
# Generated by iptables-save v1.6.0 on Thu May 12 08:59:40 2016
*filter
:INPUT DROP [54:4786]
:FORWARD ACCEPT [1146:1152945]
:OUTPUT ACCEPT [18:2656]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m multiport --dports 22,25,53,80,443 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A OUTPUT -p icmp -j DROP
COMMIT
# Completed on Thu May 12 08:59:40 2016
# Generated by iptables-save v1.6.0 on Thu May 12 08:59:40 2016
*mangle
:PREROUTING ACCEPT [22002418:14044695418]
:INPUT ACCEPT [750514:335244927]
:FORWARD ACCEPT [21247910:13704525614]
:OUTPUT ACCEPT [759521:72791753]
:POSTROUTING ACCEPT [22009789:13778175029]
-A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:65495 -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Thu May 12 08:59:40 2016
# Generated by iptables-save v1.6.0 on Thu May 12 08:59:40 2016
*nat
:PREROUTING ACCEPT [131923:10567253]
:INPUT ACCEPT [21124:1982145]
:OUTPUT ACCEPT [7356:1012014]
:POSTROUTING ACCEPT [163516:13463108]
-A PREROUTING -d 46.146.235.212/32 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 192.168.1.101:8081
-A POSTROUTING -d 192.168.1.101/32 -p tcp -m tcp --dport 8081 -j SNAT --to-source 46.146.235.212
-A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT
# Completed on Thu May 12 08:59:40 2016

Answer 1

[Hidevs]

похоже вот это помогло:

iptables -t nat -I PREROUTING 1 -i enp3s2 -p udp --dport 53 -j DNAT --to-destination 8.8.8.8:53
iptables -t nat -I PREROUTING 1 -i enp3s2 -p tcp --dport 53 -j DNAT --to-destination 8.8.8.8:53
iptables -t nat -I PREROUTING 1 -i enp3s1 -p tcp --dport 53 -j DNAT --to-destination 8.8.8.8:53
iptables -t nat -I PREROUTING 1 -i enp3s1 -p udp --dport 53 -j DNAT --to-destination 8.8.8.8:53
iptables -t nat -I OUTPUT 1 -o ppp0 -p udp --dport 53 -j DNAT --to-destination 8.8.8.8:53
iptables -t nat -I OUTPUT 1 -o ppp0 -p tcp --dport 53 -j DNAT --to-destination 8.8.8.8:53

Comments

[Hidevs]

да, все заработало, нормально iptables выглядит?

Answer 2

[Александр]

DNS работает по протоколу UDP на 53 порту, а у вас он в TCP прописан

Answer 3

[Денис Сечин]

Надо разрешить прохождения по 53 порту но udp