Redirecting DNS Not Working

Redirecting DNS Not Working

[John Corps]

Hello All,

I am having issues with redirecting DNS requests to the internal dns
server. I have a very simple setup, if someone is put into vlan 1000
then they do not get internet access at all. If they keep the DNS
server assigned by DHCP, which is the IP of the gateway in vlan 1000,
every request they make to a website is resolved to this IP and served
up the webpage stating no internet is available. If they are clever
enough to set there own DNS servers, when they open a browser, they do
not get anything at all, just page can't be displayed. I have not done
anything with iptables yet as the internal dns server is just
resolving everything to the local IP address. What I want to do is if
they set there own DNS, redirect them anyways back to the internal
DNS. Here are the only 2 rules I have tried but they do not work at
all, maybe i am missing something? Any help would be greatly
appreciated!

iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
53 -j REDIRECT --to-ports 53
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
53 -j REDIRECT --to-ports 53

Re: Redirecting DNS Not Working

[Andrew Beverley]

On Fri, 2013-02-15 at 11:24 -0500, John Corps wrote:
> Hello All,
> 
> I am having issues with redirecting DNS requests to the internal dns
> server. I have a very simple setup, if someone is put into vlan 1000
> then they do not get internet access at all. If they keep the DNS
> server assigned by DHCP, which is the IP of the gateway in vlan 1000,
> every request they make to a website is resolved to this IP and served
> up the webpage stating no internet is available. If they are clever
> enough to set there own DNS servers, when they open a browser, they do
> not get anything at all, just page can't be displayed. I have not done
> anything with iptables yet as the internal dns server is just
> resolving everything to the local IP address. What I want to do is if
> they set there own DNS, redirect them anyways back to the internal
> DNS. Here are the only 2 rules I have tried but they do not work at
> all, maybe i am missing something? Any help would be greatly
> appreciated!
> 
> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
> 53 -j REDIRECT --to-ports 53
> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
> 53 -j REDIRECT --to-ports 53

If you want to redirect the requests to the local server, then you'll
need to use the DNAT target instead. All you're doing in your rules is
changing to port 53 a packet that is destined to port 53 (so nothing at
all).

Andy

Re: Redirecting DNS Not Working

[John Corps]

Whoops! forgot to reply to all and sent this only to Andy.

Tried this... and same result, page not displayed. Keep in mind these
are the only rules I have for iptables, do I need any other ones?

iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT
--to-destination 192.168.1.2:53
iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT
--to-destination 192.168.1.2:53
iptables -t nat -A PREROUTING -p tcp --sport 53 -j DNAT
--to-destination 192.168.1.2:53
iptables -t nat -A PREROUTING -p tcp --sport 53 -j DNAT
--to-destination 192.168.1.2:53

On Fri, Feb 15, 2013 at 11:35 AM, Andrew Beverley <andy@andybev.com> wrote:
> On Fri, 2013-02-15 at 11:24 -0500, John Corps wrote:
>> Hello All,
>>
>> I am having issues with redirecting DNS requests to the internal dns
>> server. I have a very simple setup, if someone is put into vlan 1000
>> then they do not get internet access at all. If they keep the DNS
>> server assigned by DHCP, which is the IP of the gateway in vlan 1000,
>> every request they make to a website is resolved to this IP and served
>> up the webpage stating no internet is available. If they are clever
>> enough to set there own DNS servers, when they open a browser, they do
>> not get anything at all, just page can't be displayed. I have not done
>> anything with iptables yet as the internal dns server is just
>> resolving everything to the local IP address. What I want to do is if
>> they set there own DNS, redirect them anyways back to the internal
>> DNS. Here are the only 2 rules I have tried but they do not work at
>> all, maybe i am missing something? Any help would be greatly
>> appreciated!
>>
>> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
>> 53 -j REDIRECT --to-ports 53
>> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
>> 53 -j REDIRECT --to-ports 53
>
> If you want to redirect the requests to the local server, then you'll
> need to use the DNAT target instead. All you're doing in your rules is
> changing to port 53 a packet that is destined to port 53 (so nothing at
> all).
>
> Andy
>
>

Re: Redirecting DNS Not Working

[Andrew Beverley]

On Fri, 2013-02-15 at 11:46 -0500, John Corps wrote:
> >> What I want to do is if
> >> they set there own DNS, redirect them anyways back to the internal
> >> DNS. Here are the only 2 rules I have tried but they do not work at
> >> all, maybe i am missing something? Any help would be greatly
> >> appreciated!
> >>
> >> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
> >> 53 -j REDIRECT --to-ports 53
> >> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
> >> 53 -j REDIRECT --to-ports 53
> >
> > If you want to redirect the requests to the local server, then you'll
> > need to use the DNAT target instead. All you're doing in your rules is
> > changing to port 53 a packet that is destined to port 53 (so nothing at
> > all).
>
> Tried this... and same result, page not displayed. Keep in mind these
> are the only rules I have for iptables, do I need any other ones?

[ Please don't top-post ]
 
> iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT
> --to-destination 192.168.1.2:53
> iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT
> --to-destination 192.168.1.2:53

It probably won't matter, but I would add the interface or source IP
addresses, in order to only match packets from your local network.

These 2 rules alone should work. To debug, I would change the target to
LOG and check that the packets are being matched successfully.

> iptables -t nat -A PREROUTING -p tcp --sport 53 -j DNAT
> --to-destination 192.168.1.2:53
> iptables -t nat -A PREROUTING -p tcp --sport 53 -j DNAT
> --to-destination 192.168.1.2:53

You don't need these. They may be messing up the packets being sent from
the external DNS server.

Andy

Re: Redirecting DNS Not Working

[John Corps]

On Fri, Feb 15, 2013 at 12:05 PM, Andrew Beverley <andy@andybev.com> wrote:
> On Fri, 2013-02-15 at 11:46 -0500, John Corps wrote:
>> >> What I want to do is if
>> >> they set there own DNS, redirect them anyways back to the internal
>> >> DNS. Here are the only 2 rules I have tried but they do not work at
>> >> all, maybe i am missing something? Any help would be greatly
>> >> appreciated!
>> >>
>> >> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
>> >> 53 -j REDIRECT --to-ports 53
>> >> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
>> >> 53 -j REDIRECT --to-ports 53
>> >
>> > If you want to redirect the requests to the local server, then you'll
>> > need to use the DNAT target instead. All you're doing in your rules is
>> > changing to port 53 a packet that is destined to port 53 (so nothing at
>> > all).
>>
>> Tried this... and same result, page not displayed. Keep in mind these
>> are the only rules I have for iptables, do I need any other ones?
>
> [ Please don't top-post ]
>
>> iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT
>> --to-destination 192.168.1.2:53
>> iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT
>> --to-destination 192.168.1.2:53
>
> It probably won't matter, but I would add the interface or source IP
> addresses, in order to only match packets from your local network.
>
> These 2 rules alone should work. To debug, I would change the target to
> LOG and check that the packets are being matched successfully.
>
>> iptables -t nat -A PREROUTING -p tcp --sport 53 -j DNAT
>> --to-destination 192.168.1.2:53
>> iptables -t nat -A PREROUTING -p tcp --sport 53 -j DNAT
>> --to-destination 192.168.1.2:53
>
> You don't need these. They may be messing up the packets being sent from
> the external DNS server.
>
> Andy
>
>

Very odd...put on a simple logging of
iptables -A INPUT -i eth1 -j LOG --log-prefix "DNS TEST INPUT drop: "

getting nothing in the logs...this is mind baffling. Even with TCPDUMP
not seeing any packets unless i set client DNS to local ip of server,
the 192.168.1.2 dns, set it to google for a test of 8.8.8.8 and get
nothing in logs or with tcpdump.

Re: Redirecting DNS Not Working

[/dev/rob0]

On Fri, Feb 15, 2013 at 11:24:15AM -0500, John Corps wrote:
> I am having issues with redirecting DNS requests to the internal 
> dns server. I have a very simple setup, if someone is put into vlan 
> 1000 then they do not get internet access at all. If they keep the 
> DNS server assigned by DHCP, which is the IP of the gateway in vlan 
> 1000, every request they make to a website is resolved to this IP 
> and served up the webpage stating no internet is available. If they 
> are clever enough to set there own DNS servers, when they open a 
> browser, they do not get anything at all, just page can't be 
> displayed.

A web browser is not useful as a DNS diagnostic tool. Become familiar 
with dig(1) for that purpose.

> I have not done anything with iptables yet as the 
> internal dns server is just resolving everything to the local IP 
> address. What I want to do is if they set there own DNS, redirect 
> them anyways back to the internal DNS.

This might not be possible, because of the way DNS works. A caching
nameserver doing recursion will require authoritative answers from 
[what it believes are] authoritative NS hosts for a zone. Since it's 
being redirected and not actually contacting the parent zones for 
referral, it will not be seeing the kind of responses it expects.

> Here are the only 2 rules I 
> have tried but they do not work at all, maybe i am missing 
> something? Any help would be greatly appreciated!
> 
> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp 
> --dport 53 -j REDIRECT --to-ports 53
> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp 
> --dport 53 -j REDIRECT --to-ports 53

I'd always restrict any NAT rule by interface, in this case -i for 
the incoming interface.

Use targeted dig commands to find out what's happening. Examples:
$ dig @your.ip.add.ress netfilter.org. any
$ dig @8.8.4.4 netfilter.org. any
$ dig @random.ip.add.ress netfilter.org. any
$ dig @193.175.24.33 netfilter.org. any

(The last of those is one of the NS hosts for netfilter.org.)
-- 
  http://rob0.nodns4.us/ -- system administration and consulting
  Offlist GMX mail is seen only if "/dev/rob0" is in the Subject:

Re: Redirecting DNS Not Working

[Andrew Beverley]

On Fri, 2013-02-15 at 12:28 -0500, John Corps wrote:
> Very odd...put on a simple logging of
> iptables -A INPUT -i eth1 -j LOG --log-prefix "DNS TEST INPUT drop: "
> 
> getting nothing in the logs...this is mind baffling. Even with TCPDUMP
> not seeing any packets unless i set client DNS to local ip of server,
> the 192.168.1.2 dns, set it to google for a test of 8.8.8.8 and get
> nothing in logs or with tcpdump.

What's your network topology? Any chance that the packets are not being
routed through your server?

Re: Redirecting DNS Not Working

[John Corps]

On Fri, Feb 15, 2013 at 1:13 PM, Andrew Beverley <andy@andybev.com> wrote:
> On Fri, 2013-02-15 at 12:28 -0500, John Corps wrote:
>> Very odd...put on a simple logging of
>> iptables -A INPUT -i eth1 -j LOG --log-prefix "DNS TEST INPUT drop: "
>>
>> getting nothing in the logs...this is mind baffling. Even with TCPDUMP
>> not seeing any packets unless i set client DNS to local ip of server,
>> the 192.168.1.2 dns, set it to google for a test of 8.8.8.8 and get
>> nothing in logs or with tcpdump.
>
> What's your network topology? Any chance that the packets are not being
> routed through your server?
>
>
>

I wouldn't think they wouldn't be getting routed through as all the
test devices are all on the same switch and all on the same vlan.
It's simple a switch, the server i'm trying iptables with is plugged
into port 1 which is untagged on vlan 1000, and the client pc is on
port 2 which is also untagged on vlan 1000. There is no uplink to any
other switch or router etc, just this switch and 2 devices plugged
into it.

Since the 1 client pc is windows, i haven't got dig on that to test,
but doing simple nslookup with dns statically configured on the nic to
8.8.8.8, its trying to go to that one and gets timed out, but doing
nslookup pointing to the 192.168.1.2 which has the iptables rules,
give me back the right IP.

Re: Redirecting DNS Not Working

[Michael Ludvig]

On 16/02/2013, at 6:28, John Corps <envoys@gmail.com> wrote:

> Very odd...put on a simple logging of
> iptables -A INPUT -i eth1 -j LOG --log-prefix "DNS TEST INPUT drop: "
> 
> getting nothing in the logs...this is mind baffling. Even with TCPDUMP
> not seeing any packets unless i set client DNS to local ip of server,
> the 192.168.1.2 dns, set it to google for a test of 8.8.8.8 and get
> nothing in logs or with tcpdump.

Let me guess - your DHCP doesn't provide default gw, only client IP and DNS server.

With no default route the requests to 8.8.8.8 don't even make it out from the client (no route to host). With 192.168.1.2 it works because that IP is on the same subnet as the client and doesn't require default route to reach it. 

Could that be the reason? Just a guess...

Michael

Re: Redirecting DNS Not Working

[John Corps]

On Fri, Feb 15, 2013 at 2:15 PM, Michael Ludvig <mludvig@logix.net.nz> wrote:
> On 16/02/2013, at 6:28, John Corps <envoys@gmail.com> wrote:
>
>> Very odd...put on a simple logging of
>> iptables -A INPUT -i eth1 -j LOG --log-prefix "DNS TEST INPUT drop: "
>>
>> getting nothing in the logs...this is mind baffling. Even with TCPDUMP
>> not seeing any packets unless i set client DNS to local ip of server,
>> the 192.168.1.2 dns, set it to google for a test of 8.8.8.8 and get
>> nothing in logs or with tcpdump.
>
> Let me guess - your DHCP doesn't provide default gw, only client IP and DNS server.
>
> With no default route the requests to 8.8.8.8 don't even make it out from the client (no route to host). With 192.168.1.2 it works because that IP is on the same subnet as the client and doesn't require default route to reach it.
>
> Could that be the reason? Just a guess...
>
> Michael
>

DHCP is definitely giving out the default gateway to the clients of 192.168.1.2.

Re: Redirecting DNS Not Working

[Pascal Hambourg]

Hello,

Andrew Beverley a écrit :
> On Fri, 2013-02-15 at 11:24 -0500, John Corps wrote:
>>
>> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
>> 53 -j REDIRECT --to-ports 53
>> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
>> 53 -j REDIRECT --to-ports 53
> 
> If you want to redirect the requests to the local server, then you'll
> need to use the DNAT target instead. All you're doing in your rules is
> changing to port 53 a packet that is destined to port 53 (so nothing at
> all).

Nonsense. You should read the manpage more carefully.

QUOTE
 REDIRECT
 This  target is only valid in the nat table, in the PREROUTING and OUT-
 PUT chains, and user-defined chains which are only  called  from  those
 chains.   It redirects the packet to the machine itself by changing the
 destination IP  to  the  primary  address  of  the  incoming  interface
 (locally-generated packets are mapped to the 127.0.0.1 address).
END OF QUOTE

Re: Redirecting DNS Not Working

[Andrew Beverley]

On Sat, 2013-02-16 at 12:35 +0100, Pascal Hambourg wrote:
> Hello,
> 
> Andrew Beverley a écrit :
> > On Fri, 2013-02-15 at 11:24 -0500, John Corps wrote:
> >>
> >> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp -m tcp --dport
> >> 53 -j REDIRECT --to-ports 53
> >> iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp -m udp --dport
> >> 53 -j REDIRECT --to-ports 53
> > 
> > If you want to redirect the requests to the local server, then you'll
> > need to use the DNAT target instead. All you're doing in your rules is
> > changing to port 53 a packet that is destined to port 53 (so nothing at
> > all).
> 
> Nonsense. You should read the manpage more carefully.
> 
> QUOTE
>  REDIRECT
>  This  target is only valid in the nat table, in the PREROUTING and OUT-
>  PUT chains, and user-defined chains which are only  called  from  those
>  chains.   It redirects the packet to the machine itself by changing the
>  destination IP  to  the  primary  address  of  the  incoming  interface
>  (locally-generated packets are mapped to the 127.0.0.1 address).
> END OF QUOTE

Okay, I stand corrected, although I personally would still use the DNAT
target for that use-case :)

Incidentally, the manpage stipulates "--to-ports" but the earlier
example in the same manpage is "--to-port". Both seem to be accepted.
Any difference?

Re: Redirecting DNS Not Working

[Pascal Hambourg]

Andrew Beverley a écrit :
>> Nonsense. You should read the manpage more carefully.
>>
>> QUOTE
>>  REDIRECT
>>  This  target is only valid in the nat table, in the PREROUTING and OUT-
>>  PUT chains, and user-defined chains which are only  called  from  those
>>  chains.   It redirects the packet to the machine itself by changing the
>>  destination IP  to  the  primary  address  of  the  incoming  interface
>>  (locally-generated packets are mapped to the 127.0.0.1 address).
>> END OF QUOTE
> 
> Okay, I stand corrected, although I personally would still use the DNAT
> target for that use-case :)

Both can be used. DNAT gives more control, as it allows to specify the
destination address.

> Incidentally, the manpage stipulates "--to-ports" but the earlier
> example in the same manpage is "--to-port". Both seem to be accepted.
> Any difference?

No, it appears that partial options can be used (as long as they are
unambiguous, I guess). --to also works.