Red Hat Bugzilla – Bug 97686
DNS failing to punch through firewall due to indescriminate grep in ifup-post
Last modified: 2014-03-16 22:36:56 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030510
Description of problem:
ifup-post contains code to open the firewall for DNS replies when PEERDNS=yes.
However, there is a grep to prevent the repeated addition of DNS rules, as in:
if ! iptables -L RH-Lokkit-0-50-INPUT -n | grep -q $nameserver ; then
This of course matches any rule which the nameserver IP address is entered for.
Hence if your DNS server (or relay) has other services (smtp, etc) which the
firewall is explicitly open for, then the nameserver entries are not added and
DNS fails to work.
I have changed mine to:
if ! iptables -L RH-Lokkit-0-50-INPUT -n | grep -q "$nameserver.* --sport 53
" ; then
This slightly more specific grep ensures that only DNS lines are considered.
Version-Release number of selected component (if applicable):
Created attachment 92481 [details]
Proposed patch as detailed in text
Thanks, added to CVS. Will be in 7.25-1.