[PATCH] firewall: Restrict outgoing network access for Knot to DNS-related ports

[PATCH] firewall: Restrict outgoing network access for Knot to DNS-related ports

[Peter Müller]

Since Knot and the RPZ zone sync tool only need access to destination ports
53 (UDP + TCP) or 853 (TCP) in case of DNS over TLS, keep their firewall
rules constrained to these ports.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 src/initscripts/system/firewall | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index a97758dc3..c7627bcab 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -443,7 +443,9 @@ iptables_init() {
 	/usr/local/bin/captivectrl
 
 	# Grant Knot Resolver access
-	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p udp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport 853 -j ACCEPT
 
 	# If a Tor relay is enabled apply firewall rules
 	if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
-- 
2.51.0

Re: [PATCH] firewall: Restrict outgoing network access for Knot to DNS-related ports

[Michael Tremer]

Hello,

Thank you for this patch. Very sensible adjustment.

Best,
-Michael

> On 25 Aug 2026, at 14:29, Peter Müller <peter.mueller@ipfire.org> wrote:
> 
> Since Knot and the RPZ zone sync tool only need access to destination ports
> 53 (UDP + TCP) or 853 (TCP) in case of DNS over TLS, keep their firewall
> rules constrained to these ports.
> 
> Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
> ---
> src/initscripts/system/firewall | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
> index a97758dc3..c7627bcab 100644
> --- a/src/initscripts/system/firewall
> +++ b/src/initscripts/system/firewall
> @@ -2,7 +2,7 @@
> ###############################################################################
> #                                                                             #
> # IPFire.org - A linux based firewall                                         #
> -# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
> +# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
> #                                                                             #
> # This program is free software: you can redistribute it and/or modify        #
> # it under the terms of the GNU General Public License as published by        #
> @@ -443,7 +443,9 @@ iptables_init() {
> /usr/local/bin/captivectrl
> 
> # Grant Knot Resolver access
> - iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -j ACCEPT
> + iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p udp --dport  53 -j ACCEPT
> + iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport  53 -j ACCEPT
> + iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport 853 -j ACCEPT
> 
> # If a Tor relay is enabled apply firewall rules
> if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
> -- 
> 2.51.0
>