Firewall Rules for a DNS Server

DNS on TCP and UDP 53. Only for authoritative servers; a resolver should answer your own network only. The services are already ticked: add your own addresses and pick your firewall.

  • Free
  • No Sign-Up
  • Runs in Your Browser

Services to Open

Check Before You Apply

SSH is open to the whole internet. Limit it to your own addresses if they are fixed.

These rules replace the existing input rules. Check nothing else (Docker, fail2ban, the Proxmox firewall) manages this server's firewall first.

/etc/nftables.conf

#!/usr/sbin/nft -f
# /etc/nftables.conf: generated at frabs.net/tools/firewall-rule-generator/
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif "lo" accept
    ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } limit rate 10/second accept
    ip6 nexthdr icmpv6 accept  # IPv6 needs ICMPv6 for neighbour discovery
    tcp dport 22 accept  # SSH
    tcp dport 53 accept  # DNS
    udp dport 53 accept  # DNS
  }

  chain forward {
    type filter hook forward priority 0; policy accept;
  }

  chain output {
    type filter hook output priority 0; policy accept;
  }
}

# Apply:  nft -f /etc/nftables.conf
# Keep at boot:  systemctl enable nftables

Firewall Rule Generator

DNS Server firewall

Opendns
DefaultDrop everything else coming in
OutboundAllowed
SSHLimit to your addresses

DNS on TCP and UDP 53. Only for authoritative servers; a resolver should answer your own network only.

Apply the rules from a session you can recover: a provider console, or with a scheduled rollback, so a mistake cannot lock you out.

Server Types

Web ServerMail ServerProxmox HostDatabase ServerWireGuard VPNMinecraft ServerDNS Server

Questions

Which ports should a dns server open?
DNS on TCP and UDP 53. Only for authoritative servers; a resolver should answer your own network only.

Free Tools

More tools

All Tools
Firewall Rule GeneratorGenerate iptables, nftables and UFW rules for common server set-ups.What Is My IPYour public IP address, reverse DNS, network and ASN.Subnet CalculatorNetwork, broadcast, usable range and mask for any IPv4 or IPv6 CIDR.Chmod CalculatorLinux file permissions in octal and symbolic form, both ways.

Firewalls stop traffic coming in

Frabs stops the abuse going out: spam, scans and floods from any VM, caught by behaviour, not by port.

Start Free TrialTry the Demo