# Firewall Block Outgoing UDP 53 Specific IP

**URL:** <https://forums.rockylinux.org/t/firewall-block-outgoing-udp-53-specific-ip/13199>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-8\
**Created:** [March 13, 2024, 11:06pm UTC](https://forums.rockylinux.org/t/firewall-block-outgoing-udp-53-specific-ip/13199 "2024-03-13T23:06:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ioplex](https://avatars.discourse-cdn.com/v4/letter/i/e9a140/32.png) [@ioplex](https://forums.rockylinux.org/u/ioplex)\
**Post date:** [March 13, 2024, 11:06pm UTC](https://forums.rockylinux.org/t/firewall-block-outgoing-udp-53-specific-ip/13199/1 "2024-03-13T23:06:11Z")

</div>

I want to test failure modes in some software by blocking DNS to a specific DNS server.

I tried the following:

`# firewall-cmd --zone public --add-rich-rule='rule family="ipv4" destination address="10.11.12.99" port port="53" protocol="udp" drop' --timeout=60`

but it has no effect. Running dig:

`dig @10.11.12.99 -t A as2.msds.corp`  
… unexpectedly successful:  
`as2.msds.corp.	1200	IN	A	10.11.12.88`

Googling around doesn’t turn up any obvious answers. I guess blocking _outgoing_ traffic is not a common scenario.

Is firewalld just controlling iptables? So can I just edit iptables directly? It seems like firewall-cmd is deliberately simplified to be easier but only for simple things it seems.

Can someone provide a pointer to some documentation that explains how firewalld actuall works.

Incidentally, before I did anything, `# iptables -nvL` listed all sorts of rules like LIBVIRT and so on. But after doing `# firewall-cmd --reload` they disappeared. But the firewalld rules are still in effect.

Sounds like maybe there is an order to the rules that matters? How do I insert the rule to be higher than all existing rules?

Just trying to make sense of this all.

This is on rocky 8.9

UPDATE:

As usual I figured this out _immediately_ after posting. For the googlers …

It seems firewalld is not ideal for blocking outbound. In my case I found that using iptables directly works as expected:

`# iptables -I OUTPUT -d 10.11.12.99 -p udp --dport 53 -j DROP`

unblock with:

`# iptables -D <same params>`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [May 12, 2024, 11:06pm UTC](https://forums.rockylinux.org/t/firewall-block-outgoing-udp-53-specific-ip/13199/2 "2024-05-12T23:06:40Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.