gateway iptables dns redirect

Solution 1:

You need to put these rules in FORWARD chain:

iptables -A FORWARD -p udp -s 192.168.2.70 -d 208.67.222.222 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.2.70 -d 208.67.222.220 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -p udp -s 192.168.2.72 -d 208.67.222.222 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -p tcp -s 192.168.2.72 -d 208.67.222.220 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

Give users local DNS servers addresses via DHCP and do not bother to redirect their DNS traffic to local servers - if they manipulate with their network configuration (DNS servers configuration), they will just fail.