DNS, iptables, ip6tables, IANA and IPv6¶

Network infrastructure configuration covering DNS resolution, firewall rules using iptables and ip6tables, IANA port assignments, and IPv6 addressing. This section consolidates the protocols and tools required for network service deployment.

Overview¶

DNS Resolution¶

The Domain Name System translates human-readable hostnames into IP addresses. DNS resolution operates hierarchically, with recursive resolvers caching responses from authoritative nameservers.

DNS Resolution Hierarchy¶

flowchart TD
    Client["Stub Resolver<br/>(client)"] -->|"Query: example.com"| Recursor["Recursive Resolver<br/>(1.1.1.1, 8.8.8.8)"]
    Recursor -->|"Cache hit"| Client
    Recursor -->|"Query root"| Root["Root Nameserver<br/>(.)"]
    Root -->|"Referral: .com TLD"| Recursor
    Recursor -->|"Query TLD"| TLD["TLD Nameserver<br/>(.com)"]
    TLD -->|"Referral: ns1.example.com"| Recursor
    Recursor -->|"Query authoritative"| Auth["Authoritative Nameserver<br/>(example.com)"]
    Auth -->|"A: 93.184.216.34"| Recursor
    Recursor -->|"Response + cache TTL"| Client

Public DNS Resolvers¶

DNS Record Types¶

iptables¶

iptables is the netfilter administration tool for IPv4 packet filtering, network address translation (NAT), and packet mangling on Linux systems.

Table Structure¶

iptables operates across five tables, each handling different packet processing stages:

Packet Flow Through netfilter Hooks¶

flowchart TD
    IN["Packet Arrives<br/>(NIC)"] --> PRE["PREROUTING<br/>(raw, mangle, nat)"]
    PRE --> RT{"Routing<br/>Decision"}
    RT -->|"Local<br/>destination"| L1["INPUT<br/>(mangle, filter, security)"]
    RT -->|"Forward"| FWD["FORWARD<br/>(mangle, filter, security)"]
    RT -->|"Local<br/>process"| OUT["OUTPUT<br/>(raw, mangle, nat, filter, security)"]
    L1 --> LP["Local Process<br/>(user space)"]
    LP --> OUT
    FWD --> POST1["POSTROUTING<br/>(mangle, nat)"]
    OUT --> POST2["POSTROUTING<br/>(mangle, nat)"]
    POST1 --> DEST["To Destination"]
    POST2 --> DEST

    style IN fill:#4a90d9
    style DEST fill:#4a90d9
    style LP fill:#7ed321

Basic Ruleset¶

#!/bin/bash
# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow established and related connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow SSH with rate limiting
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP/HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Allow DNS
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT

# ICMP (ping)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Log dropped packets
iptables -A INPUT -j LOG --log-prefix "iptables-dropped: " --log-level 4
iptables -A INPUT -j DROP

Rule Target Actions¶

ip6tables¶

ip6tables is the IPv6 equivalent of iptables. The command syntax is identical, but the protocol context differs.

Critical Differences from iptables¶

• ICMPv6 is required for IPv6 neighbor discovery (address resolution) and must not be completely blocked
• IPv6 does not use NAT in standard configurations (NAT66 exists but is discouraged)
• Stateless Address Autoconfiguration (SLAAC) relies on Router Solicitation/Advertisement messages

ICMPv6 Message Types¶

IPv6 Ruleset¶

#!/bin/bash
ip6tables -F
ip6tables -X

ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT

# Established connections
ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Loopback
ip6tables -A INPUT -i lo -j ACCEPT

# ICMPv6 (essential for IPv6 operation)
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# SSH
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

# HTTP/HTTPS
ip6tables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Log and drop
ip6tables -A INPUT -j LOG --log-prefix "ip6tables-dropped: "
ip6tables -A INPUT -j DROP

IANA Port Assignments¶

IANA maintains the authoritative registry of service names and port numbers (RFC 6335). Port numbers are divided into three ranges:

flowchart LR
    subgraph WellKnown["Well-Known Ports (0-1023)"]
        direction TB
        W1["HTTP: 80"]
        W2["HTTPS: 443"]
        W3["SSH: 22"]
        W4["DNS: 53"]
    end

    subgraph User["Registered Ports (1024-49151)"]
        direction TB
        U1["OpenVPN: 1194"]
        U2["WireGuard: 51820"]
        U3["DNS over TLS: 853"]
    end

    subgraph Dynamic["Dynamic Ports (49152-65535)"]
        direction TB
        D1["Ephemeral client<br/>source ports"]
    end

    WellKnown --> User --> Dynamic

    style WellKnown fill:#4a90d9
    style User fill:#f5a623
    style Dynamic fill:#7ed321

Common Service Port Reference¶

IPv6 Addressing¶

Address Types¶

Type	Prefix	Example	Purpose
Global Unicast	2000::/3	2001:db8::1	Routable internet addresses
Unique Local	fc00::/7	fd00:1	Private networks (RFC 4193)
Link-Local	fe80::/10	fe80::1%eth0	Single-link communication
Multicast	ff00::/8	ff02::1	One-to-many delivery
Loopback	::1/128	::1	Local host
Unspecified	::/128	::	No address assigned

Unique Local Addresses (ULA)¶

RFC 4193 defines Unique Local Addresses for private IPv6 networks, analogous to RFC 1918 private IPv4 addresses. A ULA prefix has the format fd00::/8 where the 40 bits following fd are the global ID.

ULA Prefix Structure:
  +--+----+----+----+----+----+----+----+
  |fd| Global ID (40 bits)  | Subnet  |
  +--+----+----+----+----+----+----+----+
   8       40                    16    = 64 bits

Example: fd12:3456:789a::/48
         |fd|123456789a|0000| :: | /48

ULA generation (using random global ID):

# Generate random ULA prefix
GLOBAL_ID=$(openssl rand -hex 5)
echo "fd${GLOBAL_ID:0:2}:${GLOBAL_ID:2:4}:${GLOBAL_ID:6:4}::/48"
# Example output: fd1a:2b3c:4d5e::/48

IPv6 Subnetting¶

A standard IPv6 subnet uses a /64 prefix, yielding 64 bits for interface identifiers:

ISP allocation:     2001:db8:1234::/48
Site:               2001:db8:1234:0000::/56  (256 subnets)
VLAN/Subnet:        2001:db8:1234:0001::/64  (18 quintillion host addresses)
Host:               2001:db8:1234:0001::1/128

IPv6 Configuration on Windows¶

# View IPv6 addresses
Get-NetIPAddress -AddressFamily IPv6 | Select-Object IPAddress, PrefixLength, InterfaceAlias

# View IPv6 routes
Get-NetRoute -AddressFamily IPv6

# Ping IPv6
ping -6 ::1
Test-Connection -TargetName "2001:db8::1" -IPv6

# DNS lookup over IPv6
Resolve-DnsName -Name example.com -Type AAAA

DNS-over-HTTPS (DoH)¶

DNS-over-HTTPS encrypts DNS queries within HTTPS connections, preventing on-path observers from reading query contents.

Configuration¶

# Windows 11: Configure DoH via Settings or registry
# Registry path for DoH configuration:
# HKLM:\System\CurrentControlSet\Services\Dnscache\Parameters\DohWellKnownServers

# Add DoH server
$regPath = "HKLM:\System\CurrentControlSet\Services\Dnscache\Parameters\DohWellKnownServers"
New-Item -Path "$regPath\1.1.1.1" -Force
Set-ItemProperty -Path "$regPath\1.1.1.1" -Name "Template" -Value "https://cloudflare-dns.com/dns-query"

# Flush DNS cache
Clear-DnsClientCache

Related Pages¶

• iptables Deep Dive — Advanced match extensions, custom chains, performance optimization
• IPv6 — Dedicated IPv6 addressing, subnetting, and firewall configuration
• IANA Standards — Protocol numbers, OSI layer mappings, assignment procedures
• WireGuard Server — VPN tunnel configuration with iptables integration

Related Deep Hole¶

• RFC 6335: IANA Port Number Procedures — Official IANA port management procedures
• IANA Service Name and Port Number Registry — Live port database
• RFC 4193: Unique Local IPv6 Unicast Addresses — ULA specification
• nixCraft: Linux IPTables Firewall Examples — Practical iptables rulesets
• RFC 8200: Internet Protocol, Version 6 (IPv6) Specification — IPv6 protocol standard
• WireGuard Firewall Rules on Linux — iptables integration with WireGuard