I looked about but couldn't find a similar enough question.
I have some remote servers positioned on clients networks, which provide various services (raspberry pi) - and their firewall config is as follows:
Only specific IP addresses INPUT and OUTPUT to specific ports. Everything else is dropped. Key only SSH connections allowed from my own network.
Problem: One of the provided services is an email campaign creator, which send out the campaigns on behalf of the client, so the client has to be able to set the SMTP server of their own email provider.
Until now, I have been doing the setup for them, and setting the server as IP not hostname, then adding the relative rule in iptables. I would like to change this and open 53 for UDP DNS requests as follows:
# DNS Hostname Resolution /sbin/iptables -A OUTPUT -s $ip -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT #Return Path /sbin/iptables -A INPUT -d $ip -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
Are there any security holes I am completely overlooking here? Is there anything I could do to make this safer?
Any advice is appreciated.