Re: redirecting LAN->NET DNS to internal server, with SNAT

On Wed, 2022-01-12 at 18:59 -0600, Justin Pryzby wrote:
> 
> You need to make sure the reply is coming by way of the shorewall
> system.
> Which can then apply SNAT rules.

Yes, I was able to solve the problem with the following in the snat
file:

MASQUERADE	-		br-lan		udp	53

and while I was at it I added a:

MASQUERADE	-		br-lan		udp	123

since I also redirect NTP queries to an internal NTP server.

Ultimately, I suppose I was just hoping there was a more atomic way of
creating a single rule redirecting traffic coming from the LAN zone
that was heading to the Internet zone back onto LAN, intending to spoof
the Internet host.  Exactly as one would want if one wanted to have
one's local DNS answer queries for any Internet-zoned DNS server.

Or NTP server, etc.

Cheers,
b.

-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEE8B/A+mOVz5cTNBuZ2sHQNBbLyKAFAmHhumsACgkQ2sHQNBbL
yKBP0gf6A7K6aOR4BdfMF5esiUexvXHtu+qsaWY6f5yERbxC+wvAqkDYB+XuKVQs
dHcQDvFCJOY+gbqsaZxipgVX0kphOb3zLnxG83LDmBXmX3bLbXFgSpgvEsuHiIpO
5alHgLpjRD6FuyUzELYoLkMcuHsdQ5azaakqJEs32RPzsgMKX5fzGOajrCxxNJT1
Ctvyd8jgK/R8iqwkoISahQDOMP1gPo2bSCmDEib0YexySw4AtTaWKG/boVeo0zJa
SxlNbVcY2ogq56YP5R9Cxr3DEyH79KP1p7MnOGeMKsUgp7nRANGsb8ossox7+UDK
v5YLG80oIz2GpYPcL7yy6tWuBWx9jw==
=174b
-----END PGP SIGNATURE-----