Private or Local Network DNS Server Setup

Running a local DNS server like a Pi-hole, AdGuard Home, or a private home lab tool is a great project. However, opening your DNS port to the entire internet is a massive security risk. It invites attackers to use your server for DDoS amplification attacks. The smart move is to open port 53 exclusively for your trusted local network.

Locking It Down to Your Subnet

Instead of a blanket “allow” rule, you can tell UFW to only listen to your local IP range. Replace 192.168.1.0/24 in the commands below with your actual home or office network range:

sudo ufw allow from 192.168.1.0/24 to any port 53 proto udp
sudo ufw allow from 192.168.1.0/24 to any port 53 proto tcp

Allowing a Single Static IP

If you only want a single, specific machine (like a dedicated media server or a management laptop) to use this DNS server, target its exact IP address instead:

sudo ufw allow from 192.168.1.50 to any port 53 proto udp
sudo ufw allow from 192.168.1.50 to any port 53 proto tcp

Activate and Test

For these local changes to take effect, reload the UFW service:

sudo ufw reload

Finally, make sure the rules are applied correctly by viewing your active firewall table:

sudo ufw status verbose

You should see port 53 tied directly to your specific IP address or local subnet, keeping the rest of the web locked out.