* RE: How to block only MX query made to DNS server
@ 2004-11-29 18:27 Hudson Delbert J Contr 61 CS/SCBN
2004-11-30 7:26 ` pravin rane
0 siblings, 1 reply; 14+ messages in thread
From: Hudson Delbert J Contr 61 CS/SCBN @ 2004-11-29 18:27 UTC (permalink / raw)
To: 'pravin rane', Daniel Chemko, netfilter
[-- Attachment #1: Type: text/plain, Size: 2477 bytes --]
pravin,
i know a way to do this but i need to know who it is that you are
trying to block from doing mx resolution?
mx queries to the dns system.
this is a staple of bind.
internal users need this from your internal servers.
external clients needs to have the mail handler resolved
to point at the secure mail address.
need more info on who you are filtering, the query type (mx)
is self is needed.
~v/r,
piranha
-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of pravin rane
Sent: Saturday, November 27, 2004 8:18 PM
To: Daniel Chemko; netfilter@lists.netfilter.org
Subject: RE: How to block only MX query made to DNS server
That is right but only when all clients are using my
DNS server. I will not be able to block MX requests if
they are using some other DNS servers which are
out-side of my network and I can not force my clients
to use only my DNS server.
Using iptables I can build a rule for certain ICMP
TYPE Packets. Is there any rule which can match DNS
query TYPE?
regards
Pravin Rane.
--- Daniel Chemko <dchemko@smgtec.com> wrote:
> pravin rane wrote:
> > Hi all,
> >
> > I want to block DNS MX query made through my
> network.
> > What iptables rule I should use.
>
> You don't use iptables to do this. named has built
> in ACL's to determine
> who can perform what oeprations. Look at bind
> 'view's for more
> information on how to properly deal with name
> resolution issues.
>
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till You Reach
` `;'-.-' '- ._ The Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm Regards
``''---'`\ .'
`'. ' Pravin Rane.
__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail
^ permalink raw reply [flat|nested] 14+ messages in thread* RE: How to block only MX query made to DNS server
2004-11-29 18:27 How to block only MX query made to DNS server Hudson Delbert J Contr 61 CS/SCBN
@ 2004-11-30 7:26 ` pravin rane
2004-11-30 13:17 ` Jason Opperisano
0 siblings, 1 reply; 14+ messages in thread
From: pravin rane @ 2004-11-30 7:26 UTC (permalink / raw)
To: Hudson Delbert J Contr 61 CS/SCBN, Daniel Chemko, netfilter
Dear Hudson,
We are in to the Linux Solution provider.
One of our client has taken SILVER PLAN from XXX ISP
According to this plan the client can only use ports
TCP, UDP. 53,25,110,143,80,81 and ports above 1024 for
out side.
Here client can only make normal DNS queries. MX type
of queries get response like "name server can not be
reached" .
We have installed an Internal Mail-server (Sendmail).
Since ISP have blocked MX query to any DNS server
Out-side sendmail is not able to send mails out-side.
I know I can tell sendmail not to use DNS. But before
implementing this new setup at client I want to test
it in my LABS. I want to create the same scenario as
that ISP have done.
Seeking Urgent help form Netfilter Experts.
Bye
Pravin
--- Hudson Delbert J Contr 61 CS/SCBN
<Delbert.Hudson@LOSANGELES.AF.MIL> wrote:
> pravin,
>
> i know a way to do this but i need to know who it
> is that you are
> trying to block from doing mx resolution?
>
> mx queries to the dns system.
>
> this is a staple of bind.
>
> internal users need this from your internal
> servers.
>
> external clients needs to have the mail handler
> resolved
> to point at the secure mail address.
>
> need more info on who you are filtering, the query
> type (mx)
> is self is needed.
>
> ~v/r,
> piranha
>
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On
> Behalf Of pravin rane
> Sent: Saturday, November 27, 2004 8:18 PM
> To: Daniel Chemko; netfilter@lists.netfilter.org
> Subject: RE: How to block only MX query made to DNS
> server
>
>
> That is right but only when all clients are using my
> DNS server. I will not be able to block MX requests
> if
> they are using some other DNS servers which are
> out-side of my network and I can not force my
> clients
> to use only my DNS server.
>
> Using iptables I can build a rule for certain ICMP
> TYPE Packets. Is there any rule which can match DNS
> query TYPE?
>
> regards
> Pravin Rane.
> --- Daniel Chemko <dchemko@smgtec.com> wrote:
>
> > pravin rane wrote:
> > > Hi all,
> > >
> > > I want to block DNS MX query made through my
> > network.
> > > What iptables rule I should use.
> >
> > You don't use iptables to do this. named has built
> > in ACL's to determine
> > who can perform what oeprations. Look at bind
> > 'view's for more
> > information on how to properly deal with name
> > resolution issues.
> >
>
>
> =====
> --
>
> __..-'
>
> _.--''
>
> _...__..-'
> .'
> .'
> .'
> .'
> .------._ ;
> .-"""`-.<') `-._ .'
> (.--. _ `._ `'---.__.-' Fly High
> Till You Reach
> ` `;'-.-' '- ._ The
> Sky
> .--'`` '._ - ' .
> `""'-. `---' ,
> ''--..__ `\ Warm
> Regards
> ``''---'`\ .'
> `'. '
> Pravin Rane.
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - You care about security. So do we.
> http://promotions.yahoo.com/new_mail
>
> ATTACHMENT part 2 application/ms-tnef
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till You Reach
` `;'-.-' '- ._ The Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm Regards
``''---'`\ .'
`'. ' Pravin Rane.
__________________________________
Do you Yahoo!?
Read only the mail you want - Yahoo! Mail SpamGuard.
http://promotions.yahoo.com/new_mail
^ permalink raw reply [flat|nested] 14+ messages in thread* RE: How to block only MX query made to DNS server
2004-11-30 7:26 ` pravin rane
@ 2004-11-30 13:17 ` Jason Opperisano
2004-11-30 14:28 ` Jason Opperisano
0 siblings, 1 reply; 14+ messages in thread
From: Jason Opperisano @ 2004-11-30 13:17 UTC (permalink / raw)
To: netfilter
On Tue, 2004-11-30 at 02:26, pravin rane wrote:
> Dear Hudson,
>
> We are in to the Linux Solution provider.
>
> One of our client has taken SILVER PLAN from XXX ISP
> According to this plan the client can only use ports
> TCP, UDP. 53,25,110,143,80,81 and ports above 1024 for
> out side.
> Here client can only make normal DNS queries. MX type
> of queries get response like "name server can not be
> reached" .
>
> We have installed an Internal Mail-server (Sendmail).
> Since ISP have blocked MX query to any DNS server
> Out-side sendmail is not able to send mails out-side.
>
> I know I can tell sendmail not to use DNS. But before
> implementing this new setup at client I want to test
> it in my LABS. I want to create the same scenario as
> that ISP have done.
>
> Seeking Urgent help form Netfilter Experts.
>
> Bye
> Pravin
you could also do this (since it's a lab scenario):
1) make sure your firewall points to whatever DNS server you wish and
can resolve whatever RR types you wish.
2) use these rules to redirect DNS traffic to what we will call a
"lightweight" DNS proxy on the firewall:
iptables -t nat -A PREROUTING -i $INSIDE_IF -p udp --dport 53 \
-j REDIRECT --to-ports 5353
iptables -A INPUT -i $INSIDE_IF -p udp --dport 5353 -j ACCEPT
3) grab the Net::DNS perl module and run the following script which
should resolve any query but MX:
--- BEGIN PERL SCRIPT ---
#!/usr/bin/perl
use strict;
use Net::DNS;
use Net::DNS::Nameserver;
use Net::DNS::Resolver;
my $listenip = "127.0.0.1";
my $listenport = "5353";
my $verbose = 1;
my $ns = Net::DNS::Nameserver->new(
LocalAddr => $listenip,
LocalPort => $listenport,
ReplyHandler => \&reply_handler,
Verbose => $verbose
);
sub reply_handler {
my ($qname, $qclass, $qtype, $peerhost) = @_;
my ($rcode, @ans, @auth, @add);
if ($qtype eq "MX") {
$rcode = "NXDOMAIN";
return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
} else {
my $res = Net::DNS::Resolver->new;
my $query = $res->search("$qname", "$qtype", "$qclass");
if ($query) {
foreach my $rr ($query->answer) {
next if $rr->type eq "CNAME";
push @ans, Net::DNS::RR->new($rr->string);
$rcode = "NOERROR";
return ($rcode, \@ans, \@auth, \@add);
}
}
}
}
$ns->main_loop;
--- END PERL SCRIPT ---
$ dig yahoo.com mx
should return a list of mail servers; whereas,
$ dig @127.0.0.1 -p 5353 yahoo.com mx
should not.
i do not believe in the string match.
-j
--
"I'm not a bad guy! I work hard, and I love my kids. So why should
I spend half my Sunday hearing about how I'm going to Hell?"
--The Simpsons
^ permalink raw reply [flat|nested] 14+ messages in thread* RE: How to block only MX query made to DNS server
2004-11-30 13:17 ` Jason Opperisano
@ 2004-11-30 14:28 ` Jason Opperisano
0 siblings, 0 replies; 14+ messages in thread
From: Jason Opperisano @ 2004-11-30 14:28 UTC (permalink / raw)
To: netfilter
On Tue, 2004-11-30 at 08:17, Jason Opperisano wrote:
whoops...
> my $listenip = "127.0.0.1";
^^^^^^^^^
that should be the inside IP of the firewall in order for it to work
properly with the REDIRECT statement...
> my $listenport = "5353";
> my $verbose = 1;
>
> my $ns = Net::DNS::Nameserver->new(
> LocalAddr => $listenip,
> LocalPort => $listenport,
> ReplyHandler => \&reply_handler,
> Verbose => $verbose
> );
>
> sub reply_handler {
> my ($qname, $qclass, $qtype, $peerhost) = @_;
> my ($rcode, @ans, @auth, @add);
>
> if ($qtype eq "MX") {
> $rcode = "NXDOMAIN";
> return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
> } else {
> my $res = Net::DNS::Resolver->new;
> my $query = $res->search("$qname", "$qtype", "$qclass");
> if ($query) {
> foreach my $rr ($query->answer) {
> next if $rr->type eq "CNAME";
> push @ans, Net::DNS::RR->new($rr->string);
> $rcode = "NOERROR";
> return ($rcode, \@ans, \@auth, \@add);
> }
> }
# i also forgot to add this here
# if query fails, send negative response
else {
$rcode = "NXDOMAIN";
return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
}
> }
> }
>
> $ns->main_loop;
> --- END PERL SCRIPT ---
-j
--
"Be careful when we capture him! We cannot claim the reward unless
we have 51% of the carcass"
--The Simpsons
^ permalink raw reply [flat|nested] 14+ messages in thread
* RE: How to block only MX query made to DNS server
@ 2004-11-30 10:36 hclfm
2004-11-30 11:46 ` Leonardo Rodrigues Magalhães
2004-11-30 11:50 ` pravin rane
0 siblings, 2 replies; 14+ messages in thread
From: hclfm @ 2004-11-30 10:36 UTC (permalink / raw)
To: pravin rane; +Cc: netfilter
>>I tried to run following command
>># iptables -t filter -A INPUT -p udp --dport 53 -m
string --string "MX" -j DROP
>>But I am getting Error like
>>iptables v1.2.8: Couldn't load match
>>`string':/lib/iptables/libipt_string.so: cannot open
>>shared object file: No such file or directory
>>:-( Do I need to upgrade my iptables RPM
Yes. Or rebuild kernel with strings modules support and compile iptables
userspace
again if necessary. Sorry for top posting in my previous reply.
regards,
U.SivaKumar
Security Consultant,
HCL Infosystems Limited.
--- hclfm@pricol.co.in wrote:
---------------------------------
Hi,
In your Linux gateway.
iptables -A INPUT -p udp --dport 53 -m string --string
"MX" -j DROP
regards,
U.SivaKumar,
"Vision is the art of seeing things invisible."
-Jonathon Swift
pravin rane <pgr_80@yahoo.com>
Sent by: netfilter-bounces@lists.netfilter.org
11/29/2004 11:26 PM PST
To: Hudson Delbert J Contr 61 CS/SCBN
<Delbert.Hudson@LOSANGELES.AF.MIL>, Daniel Chemko
<dchemko@smgtec.com>, netfilter@lists.netfilter.org
cc:
bcc:
Subject: RE: How to block only MX query made to DNS
server
Dear Hudson,
We are in to the Linux Solution provider.
One of our client has taken SILVER PLAN from XXX ISP
According to this plan the client can only use ports
TCP, UDP. 53,25,110,143,80,81 and ports above 1024 for
out side.
Here client can only make normal DNS queries. MX type
of queries get response like "name server can not be
reached" .
We have installed an Internal Mail-server (Sendmail).
Since ISP have blocked MX query to any DNS server
Out-side sendmail is not able to send mails out-side.
I know I can tell sendmail not to use DNS. But before
implementing this new setup at client I want to test
it in my LABS. I want to create the same scenario as
that ISP have done.
Seeking Urgent help form Netfilter Experts.
Bye
Pravin
--- Hudson Delbert J Contr 61 CS/SCBN
<Delbert.Hudson@LOSANGELES.AF.MIL> wrote:
> pravin,
>
> i know a way to do this but i need to know who it
> is that you are
> trying to block from doing mx resolution?
>
> mx queries to the dns system.
>
> this is a staple of bind.
>
> internal users need this from your internal
> servers.
>
> external clients needs to have the mail handler
> resolved
> to point at the secure mail address.
>
> need more info on who you are filtering, the query
> type (mx)
> is self is needed.
>
> ~v/r,
> piranha
>
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On
> Behalf Of pravin rane
> Sent: Saturday, November 27, 2004 8:18 PM
> To: Daniel Chemko; netfilter@lists.netfilter.org
> Subject: RE: How to block only MX query made to DNS
> server
>
>
> That is right but only when all clients are using my
> DNS server. I will not be able to block MX requests
> if
> they are using some other DNS servers which are
> out-side of my network and I can not force my
> clients
> to use only my DNS server.
>
> Using iptables I can build a rule for certain ICMP
> TYPE Packets. Is there any rule which can match DNS
> query TYPE?
>
> regards
> Pravin Rane.
> --- Daniel Chemko <dchemko@smgtec.com> wrote:
>
> > pravin rane wrote:
> > > Hi all,
> > >
> > > I want to block DNS MX query made through my
> > network.
> > > What iptables rule I should use.
> >
> > You don't use iptables to do this. named has built
> > in ACL's to determine
> > who can perform what oeprations. Look at bind
> > 'view's for more
> > information on how to properly deal with name
> > resolution issues.
> >
>
>
> =====
> --
>
> __..-'
>
> _.--''
>
> _...__..-'
> .'
> .'
> .'
> .'
> .------._ ;
> .-"""`-.<') `-._ .'
> (.--. _ `._ `'---.__.-' Fly High
> Till You Reach
> ` `;'-.-' '- ._ The
> Sky
> .--'`` '._ - ' .
> `""'-. `---' ,
> ''--..__ `\ Warm
> Regards
> ``''---'`\ .'
> `'. '
> Pravin Rane.
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - You care about security. So do we.
> http://promotions.yahoo.com/new_mail
>
> ATTACHMENT part 2 application/ms-tnef
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till
You Reach
` `;'-.-' '- ._ The
Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm
Regards
``''---'`\ .'
`'. ' Pravin
Rane.
__________________________________
Do you Yahoo!?
Read only the mail you want - Yahoo! Mail SpamGuard.
http://promotions.yahoo.com/new_mail
__________________________________
Do you Yahoo!?
The all-new My Yahoo! - What will yours do?
http://my.yahoo.com
^ permalink raw reply [flat|nested] 14+ messages in thread* Re: How to block only MX query made to DNS server
2004-11-30 10:36 hclfm
@ 2004-11-30 11:46 ` Leonardo Rodrigues Magalhães
2004-11-30 11:50 ` pravin rane
1 sibling, 0 replies; 14+ messages in thread
From: Leonardo Rodrigues Magalhães @ 2004-11-30 11:46 UTC (permalink / raw)
To: netfilter
Dont forget that this rule will block ANY type of resolutions for
domains that contains MX in their names, just like 'flashmx.com' for
example.
I think you should get some tcpdump's and get the exactly HEX dump of
the MX query type and use with --string --hex-string instead of using simple
string rules.
Sincerily,
Leonardo Rodrigues
----- Original Message -----
From: <hclfm@pricol.co.in>
To: "pravin rane" <pgr_80@yahoo.com>
Cc: <netfilter@lists.netfilter.org>
Sent: Tuesday, November 30, 2004 7:36 AM
Subject: RE: How to block only MX query made to DNS server
>
>>>I tried to run following command
>
>>># iptables -t filter -A INPUT -p udp --dport 53 -m
> string --string "MX" -j DROP
>
>>>But I am getting Error like
>
>>>iptables v1.2.8: Couldn't load match
>>>`string':/lib/iptables/libipt_string.so: cannot open
>>>shared object file: No such file or directory
>
>>>:-( Do I need to upgrade my iptables RPM
>
> Yes. Or rebuild kernel with strings modules support and compile iptables
> userspace
> again if necessary. Sorry for top posting in my previous reply.
^ permalink raw reply [flat|nested] 14+ messages in thread* RE: How to block only MX query made to DNS server
2004-11-30 10:36 hclfm
2004-11-30 11:46 ` Leonardo Rodrigues Magalhães
@ 2004-11-30 11:50 ` pravin rane
1 sibling, 0 replies; 14+ messages in thread
From: pravin rane @ 2004-11-30 11:50 UTC (permalink / raw)
To: hclfm; +Cc: netfilter
--- hclfm@pricol.co.in wrote:
>
>
>
> >>I tried to run following command
>
> >># iptables -t filter -A INPUT -p udp --dport 53 -m
> string --string "MX" -j DROP
>
> >>But I am getting Error like
>
> >>iptables v1.2.8: Couldn't load match
> >>`string':/lib/iptables/libipt_string.so: cannot
> open
> >>shared object file: No such file or directory
>
> >>:-( Do I need to upgrade my iptables RPM
>
> Yes. Or rebuild kernel with strings modules support
> and compile iptables
> userspace
> again if necessary. Sorry for top posting in my
> previous reply.
>
> regards,
>
> U.SivaKumar
> Security Consultant,
> HCL Infosystems Limited.
>
>
> --- hclfm@pricol.co.in wrote:
>
>
> ---------------------------------
Hi
Thanks I will do that :D
Thanks
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till You Reach
` `;'-.-' '- ._ The Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm Regards
``''---'`\ .'
`'. ' Pravin Rane.
__________________________________
Do you Yahoo!?
Yahoo! Mail - Helps protect you from nasty viruses.
http://promotions.yahoo.com/new_mail
^ permalink raw reply [flat|nested] 14+ messages in thread
[parent not found: <OFF16F8905.C3905D39-ON65256F5C.002D9EA6@pricol.co.in>]
* RE: How to block only MX query made to DNS server
[not found] <OFF16F8905.C3905D39-ON65256F5C.002D9EA6@pricol.co.in>
@ 2004-11-30 8:53 ` pravin rane
2004-11-30 12:35 ` a.ledvinka
0 siblings, 1 reply; 14+ messages in thread
From: pravin rane @ 2004-11-30 8:53 UTC (permalink / raw)
To: hclfm; +Cc: netfilter
Hi
First of all Thanks for your prompt response. :)
I tried to run following command
# iptables -t filter -A INPUT -p udp --dport 53 -m
string --string "MX" -j DROP
But I am getting Error like
iptables v1.2.8: Couldn't load match
`string':/lib/iptables/libipt_string.so: cannot open
shared object file: No such file or directory
:-( Do I need to upgrade my iptables RPM
Bye
Pravin Rane
--- hclfm@pricol.co.in wrote:
---------------------------------
Hi,
In your Linux gateway.
iptables -A INPUT -p udp --dport 53 -m string --string
"MX" -j DROP
regards,
U.SivaKumar,
"Vision is the art of seeing things invisible."
-Jonathon Swift
pravin rane <pgr_80@yahoo.com>
Sent by: netfilter-bounces@lists.netfilter.org
11/29/2004 11:26 PM PST
To: Hudson Delbert J Contr 61 CS/SCBN
<Delbert.Hudson@LOSANGELES.AF.MIL>, Daniel Chemko
<dchemko@smgtec.com>, netfilter@lists.netfilter.org
cc:
bcc:
Subject: RE: How to block only MX query made to DNS
server
Dear Hudson,
We are in to the Linux Solution provider.
One of our client has taken SILVER PLAN from XXX ISP
According to this plan the client can only use ports
TCP, UDP. 53,25,110,143,80,81 and ports above 1024 for
out side.
Here client can only make normal DNS queries. MX type
of queries get response like "name server can not be
reached" .
We have installed an Internal Mail-server (Sendmail).
Since ISP have blocked MX query to any DNS server
Out-side sendmail is not able to send mails out-side.
I know I can tell sendmail not to use DNS. But before
implementing this new setup at client I want to test
it in my LABS. I want to create the same scenario as
that ISP have done.
Seeking Urgent help form Netfilter Experts.
Bye
Pravin
--- Hudson Delbert J Contr 61 CS/SCBN
<Delbert.Hudson@LOSANGELES.AF.MIL> wrote:
> pravin,
>
> i know a way to do this but i need to know who it
> is that you are
> trying to block from doing mx resolution?
>
> mx queries to the dns system.
>
> this is a staple of bind.
>
> internal users need this from your internal
> servers.
>
> external clients needs to have the mail handler
> resolved
> to point at the secure mail address.
>
> need more info on who you are filtering, the query
> type (mx)
> is self is needed.
>
> ~v/r,
> piranha
>
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On
> Behalf Of pravin rane
> Sent: Saturday, November 27, 2004 8:18 PM
> To: Daniel Chemko; netfilter@lists.netfilter.org
> Subject: RE: How to block only MX query made to DNS
> server
>
>
> That is right but only when all clients are using my
> DNS server. I will not be able to block MX requests
> if
> they are using some other DNS servers which are
> out-side of my network and I can not force my
> clients
> to use only my DNS server.
>
> Using iptables I can build a rule for certain ICMP
> TYPE Packets. Is there any rule which can match DNS
> query TYPE?
>
> regards
> Pravin Rane.
> --- Daniel Chemko <dchemko@smgtec.com> wrote:
>
> > pravin rane wrote:
> > > Hi all,
> > >
> > > I want to block DNS MX query made through my
> > network.
> > > What iptables rule I should use.
> >
> > You don't use iptables to do this. named has built
> > in ACL's to determine
> > who can perform what oeprations. Look at bind
> > 'view's for more
> > information on how to properly deal with name
> > resolution issues.
> >
>
>
> =====
> --
>
> __..-'
>
> _.--''
>
> _...__..-'
> .'
> .'
> .'
> .'
> .------._ ;
> .-"""`-.<') `-._ .'
> (.--. _ `._ `'---.__.-' Fly High
> Till You Reach
> ` `;'-.-' '- ._ The
> Sky
> .--'`` '._ - ' .
> `""'-. `---' ,
> ''--..__ `\ Warm
> Regards
> ``''---'`\ .'
> `'. '
> Pravin Rane.
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - You care about security. So do we.
> http://promotions.yahoo.com/new_mail
>
> ATTACHMENT part 2 application/ms-tnef
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till
You Reach
` `;'-.-' '- ._ The
Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm
Regards
``''---'`\ .'
`'. ' Pravin
Rane.
__________________________________
Do you Yahoo!?
Read only the mail you want - Yahoo! Mail SpamGuard.
http://promotions.yahoo.com/new_mail
__________________________________
Do you Yahoo!?
The all-new My Yahoo! - What will yours do?
http://my.yahoo.com
^ permalink raw reply [flat|nested] 14+ messages in thread
* RE: How to block only MX query made to DNS server
@ 2004-11-27 21:23 Daniel Chemko
2004-11-28 4:17 ` pravin rane
0 siblings, 1 reply; 14+ messages in thread
From: Daniel Chemko @ 2004-11-27 21:23 UTC (permalink / raw)
To: pravin rane, netfilter
pravin rane wrote:
> Hi all,
>
> I want to block DNS MX query made through my network.
> What iptables rule I should use.
You don't use iptables to do this. named has built in ACL's to determine
who can perform what oeprations. Look at bind 'view's for more
information on how to properly deal with name resolution issues.
^ permalink raw reply [flat|nested] 14+ messages in thread
* RE: How to block only MX query made to DNS server
2004-11-27 21:23 Daniel Chemko
@ 2004-11-28 4:17 ` pravin rane
2004-11-28 6:21 ` Jason Opperisano
0 siblings, 1 reply; 14+ messages in thread
From: pravin rane @ 2004-11-28 4:17 UTC (permalink / raw)
To: Daniel Chemko, netfilter
That is right but only when all clients are using my
DNS server. I will not be able to block MX requests if
they are using some other DNS servers which are
out-side of my network and I can not force my clients
to use only my DNS server.
Using iptables I can build a rule for certain ICMP
TYPE Packets. Is there any rule which can match DNS
query TYPE?
regards
Pravin Rane.
--- Daniel Chemko <dchemko@smgtec.com> wrote:
> pravin rane wrote:
> > Hi all,
> >
> > I want to block DNS MX query made through my
> network.
> > What iptables rule I should use.
>
> You don't use iptables to do this. named has built
> in ACL's to determine
> who can perform what oeprations. Look at bind
> 'view's for more
> information on how to properly deal with name
> resolution issues.
>
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till You Reach
` `;'-.-' '- ._ The Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm Regards
``''---'`\ .'
`'. ' Pravin Rane.
__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail
^ permalink raw reply [flat|nested] 14+ messages in thread* RE: How to block only MX query made to DNS server
2004-11-28 4:17 ` pravin rane
@ 2004-11-28 6:21 ` Jason Opperisano
0 siblings, 0 replies; 14+ messages in thread
From: Jason Opperisano @ 2004-11-28 6:21 UTC (permalink / raw)
To: netfilter
On Sat, 2004-11-27 at 23:17, pravin rane wrote:
> That is right but only when all clients are using my
> DNS server. I will not be able to block MX requests if
> they are using some other DNS servers which are
> out-side of my network and I can not force my clients
> to use only my DNS server.
iptables -t nat -A PREROUTING -i $INSIDE_IF -p udp \
--dport 53 -j REDIRECT --to-port 53
or some variant thereof...
-j
--
"Lisa, if the Bible has taught us nothing else, and it hasn't, it's
that girls should stick to girls sports, such as hot oil wrestling
and foxy boxing and such and such."
--The Simpsons
^ permalink raw reply [flat|nested] 14+ messages in thread
* How to block only MX query made to DNS server
@ 2004-11-27 9:51 pravin rane
2004-11-28 7:40 ` Tom Marshall
0 siblings, 1 reply; 14+ messages in thread
From: pravin rane @ 2004-11-27 9:51 UTC (permalink / raw)
To: netfilter
Hi all,
I want to block DNS MX query made through my network.
What iptables rule I should use.
bye
=====
--
__..-'
_.--''
_...__..-'
.'
.'
.'
.'
.------._ ;
.-"""`-.<') `-._ .'
(.--. _ `._ `'---.__.-' Fly High Till You Reach
` `;'-.-' '- ._ The Sky
.--'`` '._ - ' .
`""'-. `---' ,
''--..__ `\ Warm Regards
``''---'`\ .'
`'. ' Pravin Rane.
__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2004-11-30 14:28 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-11-29 18:27 How to block only MX query made to DNS server Hudson Delbert J Contr 61 CS/SCBN
2004-11-30 7:26 ` pravin rane
2004-11-30 13:17 ` Jason Opperisano
2004-11-30 14:28 ` Jason Opperisano
-- strict thread matches above, loose matches on Subject: below --
2004-11-30 10:36 hclfm
2004-11-30 11:46 ` Leonardo Rodrigues Magalhães
2004-11-30 11:50 ` pravin rane
[not found] <OFF16F8905.C3905D39-ON65256F5C.002D9EA6@pricol.co.in>
2004-11-30 8:53 ` pravin rane
2004-11-30 12:35 ` a.ledvinka
2004-11-27 21:23 Daniel Chemko
2004-11-28 4:17 ` pravin rane
2004-11-28 6:21 ` Jason Opperisano
2004-11-27 9:51 pravin rane
2004-11-28 7:40 ` Tom Marshall
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox