<div dir="ltr">Hi Alarig <div><br></div><div><br></div><div>I tried that but somehow DNS traffic still does not work. I tried adding rules in prerouting as well and still no impact. </div><div><br></div><div><br></div><div><font face="monospace">anurag@RT-AC58U:/tmp/home/root# iptables -t nat -L PREROUTING -v -n<br>Chain PREROUTING (policy ACCEPT 25 packets, 3147 bytes)<br> pkts bytes target prot opt in out source destination<br><span style="background-color:rgb(255,255,0)"> 672 46143 ACCEPT udp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> udp dpt:53<br> 0 0 ACCEPT tcp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:53</span><br>anurag@RT-AC58U:/tmp/home/root# iptables -t nat -L -v -n<br>Chain PREROUTING (policy ACCEPT 63 packets, 10481 bytes)<br> pkts bytes target prot opt in out source destination<br> 993 68310 ACCEPT udp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> udp dpt:53<br> 0 0 ACCEPT tcp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:53<br><br>Chain INPUT (policy ACCEPT 46 packets, 8909 bytes)<br> pkts bytes target prot opt in out source destination<br><br>Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)<br> pkts bytes target prot opt in out source destination<br><br><span style="background-color:rgb(255,255,255)">Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)</span><br><span style="background-color:rgb(255,255,0)"> pkts bytes target prot opt in out source destination</span><br><span style="background-color:rgb(255,255,0)"> 0 0 ACCEPT tcp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> tcp dpt:53</span><br><span style="background-color:rgb(255,255,0)"> 0 0 ACCEPT udp -- * * <a href="http://0.0.0.0/0">0.0.0.0/0</a> <a href="http://0.0.0.0/0">0.0.0.0/0</a> udp dpt:53</span><br>anurag@RT-AC58U:/tmp/home/root#</font><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>From my client behind Asus Wifi AP: </div><div><br></div><div><font face="monospace"> dig @<a href="http://1.1.1.1">1.1.1.1</a> <a href="http://whoami.akamai.net">whoami.akamai.net</a><br><br>; <<>> DiG 9.10.6 <<>> @<a href="http://1.1.1.1">1.1.1.1</a> <a href="http://whoami.akamai.net">whoami.akamai.net</a><br>; (1 server found)<br>;; global options: +cmd<br>;; connection timed out; no servers could be reached<br></font></div><div><br></div><div><br></div><div><br></div><div>Whether or not I have these rules, I see no traffic on port 53 when doing tcpdump on the core router (in the North of Asus wifi AP). So clearly firewall rules are not working. </div><div>Please suggest if you see something wrong here. </div><div><br></div><div><br></div><div>Also, in meantime, I heard from Asus and their support mentioned that this re-writing is intentional and is done so that end users can access device on <a href="http://router.asus.com">router.asus.com</a> hostname. I requested them to make this feature optional so that at least folks like us can disable it. Let's see how that goes. </div><div><br></div><div><br></div><div><br></div><div>Thanks. </div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 29, 2020 at 3:13 PM Alarig Le Lay <<a href="mailto:alarig@swordarmor.fr">alarig@swordarmor.fr</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Thu 29 Oct 2020 02:10:25 GMT, Anurag Bhatia wrote:<br>
> I tried deleting the rule and it drops the traffic completely. So DNS<br>
> resolution stops working and I am unsure why. It's not like default drop or<br>
> anything. I can edit the rule and whatever active port 53 related rule is<br>
> there works. But I want case of no such rule at all. :-)<br>
<br>
Did you try to add<br>
-t nat -A POSTROUTING -p tcp -m tcp --dport 53 -j ACCEPT<br>
-t nat -A POSTROUTING -p udp -m udp --dport 53 -j ACCEPT<br>
<br>
after the deletion?<br>
<br>
-- <br>
Alarig<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div><span style="font-family:arial,helvetica,sans-serif">Anurag Bhatia</span><br></div><div></div><div><font face="arial, helvetica, sans-serif"><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></font></div></div></div></div></div></div>