domain name system - How does one configure UFW to allow private DNS requests, but block DNS requests from internet

I have an Ubuntu Server 12.04, with two network cards:

• eth0 is connected to the internet


• eth1 is connected to a private network (192.168.10.1)

The server is configured as a gateway and hosts DNS and DHCP fro the private network. Computers in the private network (say with IP address 192.168.10.50) can successfully connect to the internet.

The UFW rules look as follows:

Status: active


To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
67/udp on eth1             ALLOW       68/udp
53                         ALLOW       Anywhere
22                         ALLOW       Anywhere (v6)
80                         ALLOW       Anywhere (v6)
443                        ALLOW       Anywhere (v6)

67/udp on eth1             ALLOW       68/udp
53                         ALLOW       Anywhere (v6)

Any internet user can query my DNS server. I'd like to block such requests as it poses a security risk. I reset the firewall, allowed access to ports 80, 443, 22 and typed the following to only permit devices on the private network to make DNS requests.

sudo ufw allow in on eth1 to 192.168.10.1 port 53

When type the following on a Windows computer (with ip address 192.168.10.50) in the private network:

nslookup google.com. 192.168.10.1

I get a response back that looks as follows:

DNS request timed out.
    timeout was 2 seconds.
Server: Unknown
Address: 192.168.10.1

When I reset the firewall and allow access to port 53 from anywhere, everything works again.

sudo ufw allow 53

How does one configure UFW on 192.168.10.1 to

• block incoming DNS queries from the internet (aka eth0)


• allow computers in the private network to make dns queries


• allow the dns server on 192.168.10.1 to forward internal DNS requests to the internet


• work for both IPv4 and IPv6