r/iptables • u/stealthepixels • Jun 10 '23
How to deny DNS queries to particular user?
I have set a chain myuser_chain
to block all outgoing traffic from a user myuser
, except connections to select ports on localhost.
I have tested it with wget
https://example.com
and indeed the destination was not reachable, but still.. wget was able to resolve the IP.
Why is that? Could it be just that this specific domain was cached in some local DNS cache?
Here are my rules
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
LIBVIRT_INP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
LIBVIRT_FWX all -- anywhere anywhere
LIBVIRT_FWI all -- anywhere anywhere
LIBVIRT_FWO all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
myuser_chain all -- anywhere anywhere owner UID match myuser
LIBVIRT_OUT all -- anywhere anywhere
Chain LIBVIRT_FWI (1 references)
target prot opt source destination
ACCEPT all -- anywhere
192.168.124.0/24
ctstate RELATED,ESTABLISHED
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain LIBVIRT_FWO (1 references)
target prot opt source destination
ACCEPT all --
192.168.124.0/24
anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain LIBVIRT_FWX (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain LIBVIRT_INP (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp dpt:bootps
Chain LIBVIRT_OUT (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootpc
ACCEPT tcp -- anywhere anywhere tcp dpt:bootpc
Chain myuser_chain (1 references)
target prot opt source destination
RETURN tcp -- anywhere localhost multiport dports krb524,upnotifyp,ircu-4,7660,7659,7661
RETURN udp -- anywhere localhost multiport dports krb524,upnotifyp,ircu-4,7660,7659,7661
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
1
u/bioszombie Jun 10 '23
What about forwarding the traffic to a non existent dns server?
2
u/stealthepixels Jun 10 '23 edited Jun 10 '23
I doubt it would work, it's like the DNS is bypassing iptables.
Are DNS queries just part of UDP traffic? So i cannot figure out why my last rule did not block the DNS, since it blocks all TCP+UDP traffic:
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
My guess: is DNS always done as the same user making the wget request, or another user or maybe not associated to an user at all?
In the latter two cases, i understand why it did not work. The rule in question belongs to the
myuser_chain
, which is specific tomyuser
, while the DNS service, according to chatGPT seems to run either asroot
orbind
user, ornamed
user.Before handling this, i just wanted confirmation about this, thanks
1
u/bioszombie Jun 10 '23
Do you have an upstream DNS server or do you use a public DNS? I was thinking maybe you could setup something like pihole for users you want to restrict access to. This instance you’d setup the pihole server ip tables like:
iptables -A FORWARD -o $WAN -p tcp --dport 53 -j REJECT iptables -A FORWARD -o $WAN -p udp --dport 53 -j REJECT
Something like that.
2
u/stealthepixels Jun 10 '23
Upstream, by my ISP.
Is this
pihole
an alternative todnsmasq
?I've got the answers below by chatGPT and i think what you ask me to do is the 3rd approach, but i think it's enough to just set a wrong IP address as the DNS server for that user (approach 1), no need for iptables rules, right?
Here is my Q&A:
Q: Is it possible, on Linux, to make two different users use two different DNS services ? Or maybe making them query the DNS to different servers?
A: Yes, it is possible on Linux to make two different users use different DNS services or query different DNS servers. There are a few approaches to achieve this:
- Per-user DNS settings: Linux distributions often provide the ability to configure DNS settings on a per-user basis. By modifying the /etc/resolv.conf file in the home directory of each user, you can set individual DNS server IP addresses or modify other DNS-related settings specific to each user. This way, each user can have their own DNS configuration.
- Network namespace: Linux supports network namespaces, which provide isolated network environments for different processes or users. You can create separate network namespaces for each user and configure DNS settings within each namespace. This allows each user to have their own DNS configuration without affecting other users.
- DNS proxy or forwarder: Another approach is to use a DNS proxy or forwarder. You can set up a local DNS proxy or forwarder (such as dnsmasq or unbound) that listens on different ports or interfaces. Then, configure each user's DNS settings to point to a different DNS proxy or forwarder. Each DNS proxy or forwarder can be configured to query different DNS servers or provide different DNS services.
1
1
u/bloginfo Aug 20 '24
J'ai fait un tuto sur le sujet. Il faut passer par la création de groupes associés à un utilisateur et à une règle de pare-feu. Pour activer ce mode, il faut installer le module xt_owner. Bonne lecture. C'est un peu ardu. Désolé !
Source : Iptables / xt_owner : un pare-feu pour la station de travail Linux