From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Len L." Subject: Blocking access to UDP port 53 (DNS) Date: Mon, 11 Aug 2003 11:25:21 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <12CC60849165134FB7DF8570B621F4D5FC4C@mailxserver.euler.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C36025.28EB2420" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org Cc: "Len L." This is a multi-part message in MIME format. ------_=_NextPart_001_01C36025.28EB2420 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Does anyone know how to block the use of a DNS server (udp port 53) from = outside, but still have external mail be able to resolve addresses? Here is what I tried ( xxx.xxx.xxx.0 is our external net that the dns = server is on) iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j LOG --log-prefix "XXX = LOCAL UDP DNS XXX " iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j ACCEPT iptables -A INPUT -p udp -j LOG --log-prefix "XXX INPUT UDP LOG-drop XXX = " iptables -A INPUT -p udp -j DROP DNS requests from our machines works with the rules above, but here is = the message a remote system gets when someone mails us:=20 Aug 11 10:33:52 remotemachine sendmail[16732]: h7BFVAAR016730: = to=3D, ctladdr=3D = (0/0), delay=3D00:01:49, xdelay=3D00:01:49, mailer=3Desmtp, pri=3D30344, = relay=3Dmachine.ourdomain.com., dsn=3D4.0.0, stat=3DDeferred: Name = server: machine.ourdomain.com.: host name lookup failure Len Laulainen ------_=_NextPart_001_01C36025.28EB2420 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Blocking access to UDP port 53 (DNS)

Does anyone know how to block the use = of a DNS server (udp port 53) from outside, but still have external mail = be able to resolve addresses?

Here is what I tried ( xxx.xxx.xxx.0 is = our external net that the dns server is on)

iptables -A INPUT -s xxx.xxx.xxx.0/24 = -p udp -j LOG --log-prefix "XXX LOCAL UDP DNS  XXX  = "
iptables -A INPUT -s xxx.xxx.xxx.0/24 = -p udp -j ACCEPT
iptables -A INPUT -p udp -j LOG = --log-prefix "XXX INPUT UDP LOG-drop XXX  "
iptables -A INPUT -p udp -j = DROP

DNS requests from our machines works = with the rules above, but here is the message a remote system gets when = someone mails us:

Aug 11 10:33:52 remotemachine = sendmail[16732]: h7BFVAAR016730: to=3D<len@machine.ourdomain.com>, = ctladdr=3D<someone@their.domain.com> (0/0), delay=3D00:01:49, = xdelay=3D00:01:49, mailer=3Desmtp, pri=3D30344, = relay=3Dmachine.ourdomain.com., dsn=3D4.0.0, stat=3DDeferred: Name = server: machine.ourdomain.com.: host name lookup failure


Len Laulainen

------_=_NextPart_001_01C36025.28EB2420--