🚀 go-pugleaf

On Fri, 03 Jan 2003 16:17:39 GMT, nospam.koen.vdvelde@advalvas.be
(Koen Van de Velde) wrote:

>Hi,
>
>Since I converted my ipchains-rules to iptables, my local DNS-server
>doesn't work anymore.
>
snip

>As you can see : on the external interface, the IP-address is MASQ'ed,
>but the port NOT !! This is the reason why we don't get any answer
>back on these requests, because our provider does block incomming
>trafic for port 53. And therefor the local dns-server keeps sending
>requests to the different internet dns-servers hoping it will ever get
>an answer.

Assuming bind is being used, has /etc/named.conf been altered? My copy
has the following comment:
         * Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
        // query-source address * port 53;

>
>IN SHORT : 
>Why doesn't the MASQ-module of iptables translate the portnumber when
>it's MASQ'ing (and ipchains did !) ??
man iptables :
 --to-ports port[-port]
  This  specifies  a  range of source ports to use, overriding the
  default SNAT source port-selection heuristics (see above).  This
  is only valid if the rule also specifies -p tcp or -p udp.


>First I thought it wasn't doing this for DNS-request only, but taking
>a closer look, it doesn't do this for any service.
>So if two computers in my LAN start an http-request from their local
>port 1026, my linux-router/firewall will sent them both out with the
>same source-port.  I'm wondering what kind of effect this wil have !
Not an expert, but presumably the de-masq'ing process sorts it out and
sends the reply packets back where they should go. Not sure how it
would work if both requests were going the the same destination
though.
-- 
John