A common problem with server networking is that DNS (Domain Name Service) queries get blocked by a firewall. This may result in long connection establishment times with services, such as inbound SSH, resolving reverse hostnames. It can also prevent establishing outbound connections using DNS names instead of IP addresses like with operating system updates.<\/p>\n\n\n\n

Test hosting on UpCloud!<\/a><\/div>\n<\/div>\n\n\n\n

Configuring your firewall for DNS server queries<\/h2>\n\n\n\n
The UpCloud firewall<\/a> service can be configured by using either the\u00a0 UpCloud Control Panel<\/a>\u00a0or the\u00a0 API<\/a>. Many users also choose to run their own firewalls inside their servers such as iptables<\/em>\u00a0on Linux. In both cases, the DNS queries must be explicitly allowed by the firewall to have name-resolving work.<\/p>\n\n\n\n
All DNS resolvers at UpCloud have the same IP addresses regardless of the availability zone. This makes it easy to copy firewall rules from one server to another or templatize firewall rules. The DNS servers are provided automatically by the DHCP protocol and there should be no need for manual configurations in the operating system, except for the DNS firewall rules.<\/p>\n\n\n\n
The UpCloud DNS resolver IPv4 addresses are:<\/p>\n\n\n\n
\n
94.237.127.9<\/strong><\/li>\n\n\n\n
94.237.40.9<\/strong><\/li>\n<\/ul>\n\n\n\n
If your server has a public IPv6 address, you can also use IPv6 with the following servers:<\/p>\n\n\n\n
\n
2a04:3540:53::1<\/strong><\/li>\n\n\n\n
2a04:3544:53::1<\/strong><\/li>\n<\/ul>\n\n\n\n
The basic firewall rule for allowing DNS queries is to permit inbound UDP and TCP<\/strong> traffic from port 53<\/strong> to any port<\/strong> from the DNS IP addresses. While the DNS server has traditionally worked only with UDP there are several recent additions like DNSSEC and SPF which might also require TCP connections to be allowed \u2013 otherwise, some of the queries might not go through.<\/p>\n\n\n\n
You can create all required DNS firewall rules with one click by enabling the Auto-add DNS rules<\/em> at your server firewall settings and then clicking the Save changes<\/em> button.<\/p>\n\n\n\n
$\"Auto$ <\/figure>\n\n\n\nRunning your own DNS servers<\/h2>\n\n\n\n
It is also possible to use your cloud servers to provide your own DNS, which could be used as the authoritative name server for your domain. For best redundancy, it is strongly recommended that you have at least two different authoritative name servers in different locations. For example, one in our Amsterdam zone and another in Chicago.<\/p>\n\n\n\n
There are several DNS server software available<\/a> with the most common open source variants used with Linux being BIND<\/a>, PowerDNS<\/a> and djbdns<\/a>. The exact configuration for each of them is outside of the scope of this article, but you can find many excellent tutorials on the Internet, starting with the documentation for the specific DNS software.<\/p>\n\n\n\n
If you choose to set up your own name server, it is paramount to make sure that the server is not a so-called open resolver<\/strong>. These are frequently scanned and exploited by DDoS attacks against third-party targets. The key rule is to only<\/strong> serve replies to queries regarding your own domains, which the DNS is authoritative for. Recursion should only be allowed from localhost.<\/p>\n\n\n\n
Running your own nameserver will require additional firewall settings as you must also enable inbound DNS queries. In other words, allow UDP and TCP<\/strong> protocol from any address to port 53<\/strong> in your firewall rules.<\/p>\n","protected":false},"featured_media":27200,"comment_status":"open","ping_status":"closed","template":"","community-category":[108,111],"class_list":["post-24330","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry","community-category-quick-start","community-category-networking"],"acf":[],"_links":{"self":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial\/24330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/types\/tutorial"}],"replies":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/comments?post=24330"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media\/27200"}],"wp:attachment":[{"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/media?parent=24330"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/studiogo.tech\/upcloudold\/wp-json\/wp\/v2\/community-category?post=24330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}