Re: pop3 and dns

Re: pop3 and dns

[cldavis]

> -----Original Message-----
> From: Dick St.Peters [mailto:stpeters@NetHeaven.com]
> Sent: Wednesday, May 12, 2004 09:21 PM
> To: 'Cedric Blancher'
> Cc: 'Netfilter Mailing List'
> Subject: Re: pop3 and dns
>
> Cedric Blancher writes:
> > Le mer 12/05/2004 à 21:14, Dana Bourgeois a écrit :
> > > >>tcp for zone transfers
> > > > and large answers ...
> > > ...where a 'large answer' is usually taken to be a UDP packet of more
> > > than 512 bytes.
> >
> > I don't quite understand the meaning of this answer... So, I clarify.
> >
> > When a DNS server has to reply on UDP with more than 512 bytes of data,
> > it sends back an answer with TC bit (truncated) set to let client know
> > answer is not complete and have him send it again using TCP.
>
> To add my own bit of clarification, it's not large answers that need
> TCP open, it's requests that have large answers.  If the client gets a
> UDP answer with the TC bit set, it should send the query again using a
> TCP connection ... and the server must listen for such connections
> ... and its firewall must let them through.
<snip>

In following this post...

I currently only allow port 53/udp through my wall for dns. I haven't noticed many

In the even that someone is able to comprimise a dns server, what would be the best way to restrict tcp zone transfers at the firewall? Rate limiting comes to my mind, any suggestions on the actual limits?

Other suggestions?

Thanks!
Christopher Davis

Filter all but 1 calss c

[Scott Miller]

Hello all,

   I'm failry new to IPChains, and am attempting to block ALL traffic,
except that traffic from my one class c address space.  Everything I've
attempted so far has basically locked me out of the box, and had to
physically go to it and remove the changes.

   Is there a down-and-dirty way to block all traffic except from one class
c address space (or even just a group of IP's?)

Thanks,
Scott

Re: Filter all but 1 calss c

[Alistair Tonner]

On May 12, 2004 10:01 pm, Scott Miller wrote:
> Hello all,
>
>    I'm failry new to IPChains, and am attempting to block ALL traffic,

	I hope you mean iptables.   Ipchains is a different creature

> except that traffic from my one class c address space.  Everything I've
> attempted so far has basically locked me out of the box, and had to
> physically go to it and remove the changes.
>
>    Is there a down-and-dirty way to block all traffic except from one class
> c address space (or even just a group of IP's?)
	sure -- several different ways to do it ... 
	http://iptables-tutorial.frozentux.net/

	contains several excellent tutuorials on iptables.

	Won't do you much good for ipchains tho .... 

	Alistair

>
> Thanks,
> Scott

Re: Filter all but 1 calss c

[Scott Miller]

Yep, sorry, IPTables - like I said, newbie.

I'll check out the reference below.

Thanks!
Scott

----- Original Message ----- 
From: "Alistair Tonner" <Alistair@nerdnet.ca>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, May 12, 2004 9:00 PM
Subject: Re: Filter all but 1 calss c


> On May 12, 2004 10:01 pm, Scott Miller wrote:
> > Hello all,
> >
> >    I'm failry new to IPChains, and am attempting to block ALL traffic,
>
> I hope you mean iptables.   Ipchains is a different creature
>
> > except that traffic from my one class c address space.  Everything I've
> > attempted so far has basically locked me out of the box, and had to
> > physically go to it and remove the changes.
> >
> >    Is there a down-and-dirty way to block all traffic except from one
class
> > c address space (or even just a group of IP's?)
> sure -- several different ways to do it ...
> http://iptables-tutorial.frozentux.net/
>
> contains several excellent tutuorials on iptables.
>
> Won't do you much good for ipchains tho ....
>
> Alistair
>
> >
> > Thanks,
> > Scott

Re: Filter all but 1 calss c

[Alistair Tonner]

On May 12, 2004 11:31 pm, Scott Miller wrote:
> Yep, sorry, IPTables - like I said, newbie.
>
> I'll check out the reference below.
>
> Thanks!
> Scott
>

	Okay then --- 

	This will allow the box to talk ONLY to the network specified.
	Keep in mind that this might well break all SORTS of things.
	There is no port level filtering, no tcp/udp variation etc .. .but:
	it serves your request.

	You could get more elegant with interface names etc.
	(read Oskar's wonderful tutorials)

	notation -->  10.1.100.0/24	
	(or whathaveyou)

	iptables -I INPUT -s {class c address with netmask} -j ACCEPT
	iptables -I INPUT -m state -state RELATED,ESTABLISHED -j ACCEPT	
	iptables -I OUTPUT -d {class c address with netmask} -j ACCEPT
	iptables -I OUTPUT -m state -state RELATED,ESTABLISHED -j ACCEPT
	iptables -P OUTPUT DROP
	iptables -P INPUT DROP 
	iptables -P FORWARD DROP
	
	



> ----- Original Message -----
> From: "Alistair Tonner" <Alistair@nerdnet.ca>
> To: <netfilter@lists.netfilter.org>
> Sent: Wednesday, May 12, 2004 9:00 PM
> Subject: Re: Filter all but 1 calss c
>
> > On May 12, 2004 10:01 pm, Scott Miller wrote:
> > > Hello all,
> > >
> > >    I'm failry new to IPChains, and am attempting to block ALL traffic,
> >
> > I hope you mean iptables.   Ipchains is a different creature
> >
> > > except that traffic from my one class c address space.  Everything I've
> > > attempted so far has basically locked me out of the box, and had to
> > > physically go to it and remove the changes.
> > >
> > >    Is there a down-and-dirty way to block all traffic except from one
>
> class
>
> > > c address space (or even just a group of IP's?)
> >
> > sure -- several different ways to do it ...
> > http://iptables-tutorial.frozentux.net/
> >
> > contains several excellent tutuorials on iptables.
> >
> > Won't do you much good for ipchains tho ....
> >
> > Alistair
> >
> > > Thanks,
> > > Scott

RE: pop3 and dns

[Mark E. Donaldson]

 

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of
cldavis@speakeasy.net
Sent: Wednesday, May 12, 2004 6:40 PM
To: netfilter@lists.netfilter.org
Subject: Re: pop3 and dns


> -----Original Message-----
> From: Dick St.Peters [mailto:stpeters@NetHeaven.com]
> Sent: Wednesday, May 12, 2004 09:21 PM
> To: 'Cedric Blancher'
> Cc: 'Netfilter Mailing List'
> Subject: Re: pop3 and dns
> 
> Cedric Blancher writes:
> > Le mer 12/05/2004 à 21:14, Dana Bourgeois a écrit :
> > > >>tcp for zone transfers
> > > > and large answers ...
> > > ...where a 'large answer' is usually taken to be a UDP packet of 
> > > more than 512 bytes.
> > 
> > I don't quite understand the meaning of this answer... So, I clarify.
> > 
> > When a DNS server has to reply on UDP with more than 512 bytes of 
> > data, it sends back an answer with TC bit (truncated) set to let 
> > client know answer is not complete and have him send it again using TCP.
> 
> To add my own bit of clarification, it's not large answers that need 
> TCP open, it's requests that have large answers.  If the client gets a 
> UDP answer with the TC bit set, it should send the query again using a 
> TCP connection ... and the server must listen for such connections ... 
> and its firewall must let them through.
<snip>

In following this post...

I currently only allow port 53/udp through my wall for dns. I haven't
noticed many 

In the even that someone is able to comprimise a dns server, what would be
the best way to restrict tcp zone transfers at the firewall? Rate limiting
comes to my mind, any suggestions on the actual limits?

Other suggestions?

Thanks!
Christopher Davis

Christopher - You should never rely on your firewall to restrict zone
transfers. You should create an ACL in your named.conf file for hosts
permitted to request zone transfers, and then apply this against the
allow-transfers parameter.  Example below:

# Allow zone transfers from these name servers
acl "xfers" {
	192.168.1.1;
	192.168.2.1;
	localhost;
};

##########################
# ZONE TRANSFER
##########################
# Only allow hosts in the "xfers" acl do zone transfers
allow-transfer { xfers; };