I am trying to block all DNS queries from my machine by default, and only allow them for specific group of users. I try these rules:sudo sugroupadd dns-allowediptables -A OUTPUT -p udp --dport 53 -m owner --gid-owner dns-allowed -j ACCEPTiptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j REJECTWith the second, DNS queries are blocked successfully, but then i try to launch ping`` within dns-allowed group, DNS queries still blocked:sudo sg dns-allowed ping google.comping: google.com: Name or service not knownI noticed that if i use nslookup instead of ping with specifying DNS server 8.8.8.8 works when launched withing dns-allowed group, but just as ping fails, most of applications still cannot use DNS within it:sudo sg dns-allowed nslookup google.com 8.8.8.8Server:     8.8.8.8Address:    8.8.8.8#53Non-authoritative answer:Name:   google.comAddress: ....resolv.conf# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTENnameserver 8.8.8.8nameserver 8.8.4.4nameserver 127.0.0.53What is my mistake?
Jail outgoing DNS queries to single group with iptables does not work
permissions;iptables;dns;firewall;hardening