dns server

dns server

[Corin Langosch]

Hi,

im running a dns server here and i'm not sure if the following rule is enough to
allow dns queries from everywhere:

$IPTABLES -A INPUT -p udp --destination-port 53 -j ACCEPT

all other packets are reject or dropped.
  
Thanks,
Corin

Re: dns server

[Francois Peyron]

Hi,

I think you have to add the same line for the tcp protocol, I can't remember
why: I think some requests are made with udp while others with tcp.
iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT

hope this will help,

Francois
----- Original Message -----
From: "Corin Langosch" <corinl@gmx.de>
To: "IP-Tables Maillingliste" <netfilter@lists.samba.org>
Sent: Thursday, June 06, 2002 3:22 PM
Subject: dns server


> Hi,
>
> im running a dns server here and i'm not sure if the following rule is
enough to
> allow dns queries from everywhere:
>
> $IPTABLES -A INPUT -p udp --destination-port 53 -j ACCEPT
>
> all other packets are reject or dropped.
>
> Thanks,
> Corin
>
>

Re: dns server

[Raymond Leach]

What are you trying to accomplish?

Allow clients internally to query your DNS server?
Allow your DNS server to query root servers and forwarders?
Allow external people to query your DNS server?
Allow updates to slave zones on your DNS server from external DNS servers?

You should create specific rules for these situations rather than generic 
rules.

Ray

On Thursday 06 June 2002 15:31, Francois Peyron wrote:
> Hi,
>
> I think you have to add the same line for the tcp protocol, I can't
> remember why: I think some requests are made with udp while others with
> tcp. iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT
>
> hope this will help,
>
> Francois
> ----- Original Message -----
> From: "Corin Langosch" <corinl@gmx.de>
> To: "IP-Tables Maillingliste" <netfilter@lists.samba.org>
> Sent: Thursday, June 06, 2002 3:22 PM
> Subject: dns server
>
> > Hi,
> >
> > im running a dns server here and i'm not sure if the following rule is
>
> enough to
>
> > allow dns queries from everywhere:
> >
> > $IPTABLES -A INPUT -p udp --destination-port 53 -j ACCEPT
> >
> > all other packets are reject or dropped.
> >
> > Thanks,
> > Corin

-- 
----------------------------------------

Ray Leach (Technical Network Specialist)

Knowledge Factory

www: http://www.knowledgefactory.co.za

Tel: +27-11-445-8100 Direct: 445-8263

Fax: +27-11-445-8101

"No matter where you go, there you are."

----------------------------------------

Re: dns server

[Maciej Soltysiak]

Hello,

i think somebody should write a short and simple FAQ for this.
This type of questions are appearing very often.

I belive that, you do not need to add special filtering rules for
forwarders, secondaries, etc.

Properly configure your DNS server, use ACLs.

Using netfilter you can not judge whether TCP:53 packet is a zone transfer
or just a query.

Regards,
Maciej Soltysiak

Re: dns server

[Raymond Leach]

On Thursday 06 June 2002 15:45, Maciej Soltysiak wrote:
> Hello,
>
> i think somebody should write a short and simple FAQ for this.
> This type of questions are appearing very often.
>
> I belive that, you do not need to add special filtering rules for
> forwarders, secondaries, etc.
>
> Properly configure your DNS server, use ACLs.
>
> Using netfilter you can not judge whether TCP:53 packet is a zone transfer
> or just a query.
If you only expect to receive queries from internal interfaces then there 
should be no 'queries' from external sources.

>
> Regards,
> Maciej Soltysiak

-- 
----------------------------------------

Ray Leach (Technical Network Specialist)

Knowledge Factory

www: http://www.knowledgefactory.co.za

Tel: +27-11-445-8100 Direct: 445-8263

Fax: +27-11-445-8101

"No matter where you go, there you are."

----------------------------------------

Re: dns server

[Antony Stone]

On Thursday 06 June 2002 2:48 pm, Raymond Leach wrote:

> On Thursday 06 June 2002 15:45, Maciej Soltysiak wrote:

> > Using netfilter you can not judge whether TCP:53 packet is a zone
> > transfer or just a query.
>
> If you only expect to receive queries from internal interfaces then there
> should be no 'queries' from external sources.

Your statement is correct, however it does not help when you are running a 
domain name server which does need to be accessible from the outside, but you 
only want people to do standard lookups, and not zone transfers.

I agree with Maciej - you should set appropriate access controls on the name 
server itself, because netfilter cannot do it for you.


Antony.

Re: dns server

[Arne Sagnes]

  DNS, specifically Bind, has options in the named.conf to limit zone
transfers and recursive lookups.  You can use the 'allow-transfer { IP;
IP };' directive to restrict zone transfers.

Arne

On Thu, 2002-06-06 at 10:00, Antony Stone wrote:
> On Thursday 06 June 2002 2:48 pm, Raymond Leach wrote:
> 
> > On Thursday 06 June 2002 15:45, Maciej Soltysiak wrote:
> 
> > > Using netfilter you can not judge whether TCP:53 packet is a zone
> > > transfer or just a query.
> >
> > If you only expect to receive queries from internal interfaces then there
> > should be no 'queries' from external sources.
> 
> Your statement is correct, however it does not help when you are running a 
> domain name server which does need to be accessible from the outside, but you 
> only want people to do standard lookups, and not zone transfers.
> 
> I agree with Maciej - you should set appropriate access controls on the name 
> server itself, because netfilter cannot do it for you.
> 
> 
> Antony.
-- 
Arne Sagnes - Email: asagnes@tickets.com
Work: +1 216 787 8613 - Cell: +1 216 577 2319
Be careful of reading health books, you might die of a misprint.

Re: dns server

[Tony Earnshaw]

[-- Attachment #1: Type: text/plain, Size: 1343 bytes --]

tor, 2002-06-06 kl. 16:36 skrev Arne Sagnes:

>   DNS, specifically Bind, has options in the named.conf to limit zone
> transfers and recursive lookups.  You can use the 'allow-transfer { IP;
> IP };' directive to restrict zone transfers.

Yes, but this nothing to do with netfilter. Nor the purpose for which
the name server is intended.

E.g. I don't even want people querying my Compaq notebook DNS. It's a
caching DNS and not meant for others.

Nevertheless, because of the nasties on the Internet (see CERT Advisory
CA-2002-15 Denial-of-Service Vulnerability in ISC BIND 9, Original
release date: June 04, 2002), one *hell* of a lot of nasties are trying,
at the moment (yes, thanks Oskar, for pointing out the use of logging).

What they're actually trying, is to get to stop traffic to my Compaq.

Næhnenæhnenæhne, nasties! I've got iptables and you can't get me.

*That's* what Netfilter is all about.

Tony

Henne er "tickets.com" henne, Arne; du som sier at du "engang var
nordmann"? Flyttet til Utlandet, er du?

-- 

Tony Earnshaw

e-post:		tonni@billy.demon.nl
www:		http://www.billy.demon.nl
gpg public key:	http://www.billy.demon.nl/tonni.armor

Telefoon:	(+31) (0)172 530428
Mobiel:		(+31) (0)6 51153356

GPG Fingerprint = 3924 6BF8 A755 DE1A 4AD6 FA2B F7D7 6051 3BE7 B981
3BE7B981



[-- Attachment #2: Dette er en digitalt signert meldingsdel --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: dns server

[Antony Stone]

On Thursday 06 June 2002 2:22 pm, Corin Langosch wrote:

> Hi,
>
> im running a dns server here and i'm not sure if the following rule is
> enough to allow dns queries from everywhere:
>
> $IPTABLES -A INPUT -p udp --destination-port 53 -j ACCEPT

You should also allow TCP port 53.   DNS uses both.


Antony.

Re: dns server

[Daniel Bastos]

> > Hi,
> >
> > im running a dns server here and i'm not sure if the following rule is
> > enough to allow dns queries from everywhere:
> >
> > $IPTABLES -A INPUT -p udp --destination-port 53 -j ACCEPT
> 
> You should also allow TCP port 53.   DNS uses both.

As I remember, when clients query the DNS Server
the port 53/tcp is used, and when your server 
queries other servers, it uses the port 53/udp.



Best Regards,
-- 
Daniel Bastos
System Engineer
http://www.dbastos.net
GPG/PGP: http://www.dbastos.net/pgpkey.txt

Re: dns server

[Tony Earnshaw]

[-- Attachment #1: Type: text/plain, Size: 2490 bytes --]

tor, 2002-06-06 kl. 15:22 skrev Corin Langosch:

> im running a dns server here and i'm not sure if the following rule is enough to
> allow dns queries from everywhere:

> $IPTABLES -A INPUT -p udp --destination-port 53 -j ACCEPT

> all other packets are reject or dropped.

It depends what you want to do with it. And what DNS software you're
running. I.e., if it's BIND, you can do more with BIND 9 than you can
with BIND 8, more with BIND 8 than with BIND4.

Many security people might say that if you're running BIND 4 or 8, then
you shouldn't be. Some of them again might say that you should be
running BIND 9.2.

If you want to allow zone transfers or run DNSSEC, or if you allow for
large record details (TXT records etc), the you'd want to allow TCP as
well as UDP.

You might even want to allow state in your rules, in which case you'd
want to allow state in and state out.

For example if you are authoritative for your own zones and if you
(which you should have) have a slave server at some other location that
your own (i.e. your ISP's location), you might want:

# Allow queries from all clients
iptables -A INPUT -i $IFACE0 -p udp -s 0.0/0 --dport 53 -m state \
 --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE0 -p udp -d 0.0/0 --sport 53 -m state \
 --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE0 -p tcp -s 0.0/0 --dport 53 -m state \
 --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE0 -p tcp -d 0.0/0 --sport 53 -m state \
 --state ESTABLISHED -j ACCEPT

On the other hand, if you're simply running a caching nameserver for
your own site and don't care about state, then you'd maybe like to allow
traffic out again from your machine with -A OUTPUT.


If you have an internal LAN that needs to consult your DNS, then your
rules would again be different.

As I wrote, it all depends what you want to do with the server and what
it's for.

I have BIND 9.2.1 running on this particular Compaq notebook, behind
IPTABLES 1.2.6 and my firewall rules ar *completely* different for those
of a 4 machine 30-zone split DNS behind IPTABLES at my last firm, that I
had to install. 

Best,

Tony

-- 

Tony Earnshaw

e-post:		tonni@billy.demon.nl
www:		http://www.billy.demon.nl
gpg public key:	http://www.billy.demon.nl/tonni.armor

Telefoon:	(+31) (0)172 530428
Mobiel:		(+31) (0)6 51153356

GPG Fingerprint = 3924 6BF8 A755 DE1A 4AD6 FA2B F7D7 6051 3BE7 B981
3BE7B981



[-- Attachment #2: Dette er en digitalt signert meldingsdel --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: dns server

[Nick Drage]

On Thu, Jun 06, 2002 at 04:04:38PM +0200, Tony Earnshaw wrote:
> tor, 2002-06-06 kl. 15:22 skrev Corin Langosch:

<snip>

> It depends what you want to do with it. And what DNS software you're
> running. I.e., if it's BIND, you can do more with BIND 9 than you can
> with BIND 8, more with BIND 8 than with BIND4.
> 
> Many security people might say that if you're running BIND 4 or 8, then
> you shouldn't be. Some of them again might say that you should be
> running BIND 9.2.

I believe that the latest BIND 8.something is still OK, and version 8 is
being maintained as far as security patches go.

As for the rest of the thread, you're best restricting that kind of access
using named.conf as the problem is at layer 7 - the BIND application, not
layer 3 - where netfilter mostly lives.


-- 
FunkyJesus System Administration Team

Re: dns server

[Tony Earnshaw]

[-- Attachment #1: Type: text/plain, Size: 1648 bytes --]

lør, 2002-06-08 kl. 11:58 skrev Nick Drage:

> > It depends what you want to do with it. And what DNS software you're
> > running. I.e., if it's BIND, you can do more with BIND 9 than you can
> > with BIND 8, more with BIND 8 than with BIND4.

> > Many security people might say that if you're running BIND 4 or 8, then
> > you shouldn't be. Some of them again might say that you should be
> > running BIND 9.2.

> I believe that the latest BIND 8.something is still OK, and version 8 is
> being maintained as far as security patches go.

Yes, but as I wrote: You can do more with BIND 9 than with BIND 8.

> As for the rest of the thread, you're best restricting that kind of access
> using named.conf as the problem is at layer 7 - the BIND application, not
> layer 3 - where netfilter mostly lives.

Again yes, but if you have a blanket DROP policy, you're going to have
to open up ports, aren't you? The question is, what ports and for which
protocols and using what policies and what tools that iptables places at
your disposition?

Have a look at hping2 (and most probably other tools and craftsmanship,
but hping2 is my favorite of all favorites) and see what nasty things
you can do with it, if you want to, and then have a look at what you can
drop with Netfilter, that BIND simply isn't capable of.

Best,

Tony
 
-- 

Tony Earnshaw

e-post:		tonni@billy.demon.nl
www:		http://www.billy.demon.nl
gpg public key:	http://www.billy.demon.nl/tonni.armor

Telefoon:	(+31) (0)172 530428
Mobiel:		(+31) (0)6 51153356

GPG Fingerprint = 3924 6BF8 A755 DE1A 4AD6 FA2B F7D7 6051 3BE7 B981
3BE7B981



[-- Attachment #2: Dette er en digitalt signert meldingsdel --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: dns server

[Corin Langosch]

Hi,

thanks for your fast responses. well i have running bind9 on my web-server.
it should act as a primary and secondary nameserver for say about 10 domains or
so.. (may be more in the future).
i opened port 53 tcp,udp and it seems to work. for some strange reason
for some people the domains are correctly resolved some people get an error.
or has it to do that i registered these domains also some hours ago ?

thanks again,
corin

Re: dns server

[Nick Drage]

On Sat, Jun 08, 2002 at 12:21:21PM +0200, Corin Langosch wrote:

<snip>

> i opened port 53 tcp,udp and it seems to work. for some strange reason
> for some people the domains are correctly resolved some people get an error.
> or has it to do that i registered these domains also some hours ago ?

I would think so - I'd give it at least 24 hours for a domain to "work" its
way around the Internet.  Or alternatively, bounce your enquiries off the
same name servers that the other users are using and see if you can
replicate the problem.

-- 
FunkyJesus System Administration Team