Re: bind 9 and iptables

[Aleksandar Milivojevic <amilivojevic@pbl.ca>]

Quoting Nick Drage <nickd@metastasis.org.uk>
Date: Sat, 28 Aug 2004 01:44:36

> Out of interest, why only permit packets with a source port of 1024 and
> above?  This rule might not pass DNS requests if they come from a local
> DNS server being used internally, if it's set up with a "query-source"
> of port 53.  Also the use of source ports is OS dependant, so if you're
> going to watch this why not pick the range the OS uses?  The range of
> your Linux system can be found via

Good question...  Probably just a habit ;-)  Safe to use restriction without
having to worry about OS specifics.  As for query-source, options in BIND 9 for
forcing sport to 53 are there mainly as workarounds for people that have to live
with old firewall configurations and old assumptions.  Something that most new
installations really don't need.  I wouldn't be suprised at all to see those
options go away one day in future.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7