Blocking access to UDP port 53 (DNS)

Blocking access to UDP port 53 (DNS)

[Len L.]

[-- Attachment #1: Type: text/plain, Size: 959 bytes --]

Does anyone know how to block the use of a DNS server (udp port 53) from outside, but still have external mail be able to resolve addresses?

Here is what I tried ( xxx.xxx.xxx.0 is our external net that the dns server is on)

iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j LOG --log-prefix "XXX LOCAL UDP DNS  XXX  "
iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j ACCEPT
iptables -A INPUT -p udp -j LOG --log-prefix "XXX INPUT UDP LOG-drop XXX  "
iptables -A INPUT -p udp -j DROP

DNS requests from our machines works with the rules above, but here is the message a remote system gets when someone mails us: 

Aug 11 10:33:52 remotemachine sendmail[16732]: h7BFVAAR016730: to=<len@machine.ourdomain.com>, ctladdr=<someone@their.domain.com> (0/0), delay=00:01:49, xdelay=00:01:49, mailer=esmtp, pri=30344, relay=machine.ourdomain.com., dsn=4.0.0, stat=Deferred: Name server: machine.ourdomain.com.: host name lookup failure


Len Laulainen


[-- Attachment #2: Type: text/html, Size: 1716 bytes --]

Re: Blocking access to UDP port 53 (DNS)

[Ramin Dousti]

On Mon, Aug 11, 2003 at 11:25:21AM -0500, Len L. wrote:

> Does anyone know how to block the use of a DNS server (udp port 53) from outside, but still have external mail be able to resolve addresses?
> 

Yes. You set up the dns for your domain having several name servers without
your own server being listed as one (which doesn't mean that your own server
cannot be one, it can even serve as the primary but only a hidden one).
This way you make sure that the TLD or SLD is not sending any refferals to
you and you can apply the rules below without any problem (if your server
is a hidden primary, you need to provide TCP/53 and UDP/53 access from the
external secondary name servers). This is a short and cryptic description
as to what to do. For more info I defer to a DNS HowTo.

Ramin

> Here is what I tried ( xxx.xxx.xxx.0 is our external net that the dns server is on)
> 
> iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j LOG --log-prefix "XXX LOCAL UDP DNS  XXX  "
> iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j ACCEPT
> iptables -A INPUT -p udp -j LOG --log-prefix "XXX INPUT UDP LOG-drop XXX  "
> iptables -A INPUT -p udp -j DROP
> 
> DNS requests from our machines works with the rules above, but here is the message a remote system gets when someone mails us: 
> 
> Aug 11 10:33:52 remotemachine sendmail[16732]: h7BFVAAR016730: to=<len@machine.ourdomain.com>, ctladdr=<someone@their.domain.com> (0/0), delay=00:01:49, xdelay=00:01:49, mailer=esmtp, pri=30344, relay=machine.ourdomain.com., dsn=4.0.0, stat=Deferred: Name server: machine.ourdomain.com.: host name lookup failure
> 
> 
> Len Laulainen
> 

RE: Blocking access to UDP port 53 (DNS)

[Josh.Berry]

[-- Attachment #1: Type: text/plain, Size: 1766 bytes --]

If you are hosting your own DNS servers, which since they cannot resolve
email when you block DNS, you probably are.  Then you need to allow udp
53 to come in to those DNS boxes.  Do you want to restrict DNS use from
your clients to your internal DNS servers?

 

If so just:

 

iptables -A FORWARD -s <dns server> -p udp -dport 53 -j ACCEPT

 

if you are natting and need to allow DNS forwarding just:

 

iptables -t nat -A PREROUTING -p udp -I <incoming interface> -d
<incoming interface ip> --dport 53 -j DNAT -to-destination <DNS
IPADDR:53> 

 

 

-----Original Message-----
From: Len L. [mailto:len@euler.com] 
Sent: Monday, August 11, 2003 11:25 AM
To: netfilter@lists.netfilter.org
Cc: Len L.
Subject: Blocking access to UDP port 53 (DNS)

 

Does anyone know how to block the use of a DNS server (udp port 53) from
outside, but still have external mail be able to resolve addresses?

Here is what I tried ( xxx.xxx.xxx.0 is our external net that the dns
server is on) 

iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j LOG --log-prefix "XXX
LOCAL UDP DNS  XXX  " 
iptables -A INPUT -s xxx.xxx.xxx.0/24 -p udp -j ACCEPT 
iptables -A INPUT -p udp -j LOG --log-prefix "XXX INPUT UDP LOG-drop XXX
" 
iptables -A INPUT -p udp -j DROP 

DNS requests from our machines works with the rules above, but here is
the message a remote system gets when someone mails us: 

Aug 11 10:33:52 remotemachine sendmail[16732]: h7BFVAAR016730:
to=<len@machine.ourdomain.com>, ctladdr=<someone@their.domain.com>
(0/0), delay=00:01:49, xdelay=00:01:49, mailer=esmtp, pri=30344,
relay=machine.ourdomain.com., dsn=4.0.0, stat=Deferred: Name server:
machine.ourdomain.com.: host name lookup failure

 

Len Laulainen 


[-- Attachment #2: Type: text/html, Size: 6206 bytes --]