Rules for DNS

Rules for DNS

[David C. Hart]

[-- Attachment #1: Type: text/plain, Size: 494 bytes --]

I am terribly confused about what I need to accept and reject and the
associated IPTables rules for Bind to work properly without exposing our
server to exploits. Right now, I'm pretty much accepting all traffic to
and from port 53 and that's "probably" not a good thing. I'm running
IPtables on the same machine running Bind.

Can someone point me in the right direction?

Thanks.
                               ---------
            Quality Management - A Commitment to Excellence

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Rules for DNS

[Antony Stone]

On Thursday 29 January 2004 3:25 pm, David C. Hart wrote:

> I am terribly confused about what I need to accept and reject and the
> associated IPTables rules for Bind to work properly without exposing our
> server to exploits. Right now, I'm pretty much accepting all traffic to
> and from port 53 and that's "probably" not a good thing. I'm running
> IPtables on the same machine running Bind.
>
> Can someone point me in the right direction?

Allow traffic to TCP & UDP ports 53 on your DNS server, but secure it in 
/etc/named.conf using the info at http://www.isc.org under BIND - hint: stop 
people from doing zone transfers or domain updates.

Antony.

-- 
I want to build a machine that will be proud of me.

 - Danny Hillis, creator of The Connection Machine

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Rules for DNS

[Maciej Soltysiak]

> I am terribly confused about what I need to accept and reject and the
> associated IPTables rules for Bind to work properly without exposing our
> server to exploits. Right now, I'm pretty much accepting all traffic to
> and from port 53 and that's "probably" not a good thing. I'm running
> IPtables on the same machine running Bind.

> Can someone point me in the right direction?
Well, all DNS servers use udp/53 for queries and replies,
when the reply is over 512 bytes, tcp/53 is used.
tcp/53 is also used for zone transfers.

Bind also uses port 953 for remote control.

No matter if you are using a caching server or a master or slave
server, you need 53 od both udp and tcp.

Advisories about filtering tcp/53 traffic to prevent zone
transfers is crazy. You just allow zone transfers to trusted
hosts and deny to everyone else by DNS configuration.

If you are using one DNS server, port 953 is used only on localhost.
So, give udp/53 and tcp/53 to everybody you want to use your
nameserver. If it is a caching server, allow only trusted IPs
and strenghten your named configuration to allow only trusted IPs
also.
If it is a master or slave server for public Internet zones,
you want everybody to be able to ask the server for DNS resources,
so Open udp/53 and tcp/53 to everybody.

Limit tcp/953 to localhost only if this server is not to be
remotely controlled.

The simple thought is this:
In case of DNS use a firewall only to decide who should and who
should not access the service.
For security turn to trusted software known to be stable and
secure, and good configuration of the daemon.


Regards,
Maciej

Re: Rules for DNS

[Alexis]

DNS's uses udp/53 for querys and tcp/53 for zone transfers
tcp/53 is used for querys too if it exceeds 512 bytes.

M$ Windows uses tcp and udp for querys, without look the size, so for
mswin to work, you need to open both ports.

be extremely carefull if you are natting the dns server.



On Thu, 2004-01-29 at 12:25, David C. Hart wrote:
> I am terribly confused about what I need to accept and reject and the
> associated IPTables rules for Bind to work properly without exposing our
> server to exploits. Right now, I'm pretty much accepting all traffic to
> and from port 53 and that's "probably" not a good thing. I'm running
> IPtables on the same machine running Bind.
> 
> Can someone point me in the right direction?
> 
> Thanks.
>                                ---------
>             Quality Management - A Commitment to Excellence
-- 
Alexis <alexis@attla.net.ar>

Re: Rules for DNS

[Krzysztof Mazurczyk]

On Thu, 29/Jan/04 12:47:13, Alexis wrote:
> 
> be extremely carefull if you are natting the dns server.
> 
May I ask why?

Regards,
Chris