Re: Best way for one-way DNS traffic

From: Geoffrey T. Falk (gtf@cirp.org)
Date: 02/22/01 

Date: Thu, 22 Feb 2001 12:07:01 -0700 (MST)
From: "Geoffrey T. Falk" <gtf@cirp.org>
To: "H. Wade Minter" <minter@lunenburg.org>

On 22 Feb, H. Wade Minter wrote:
> My gateway box is running a name server for my home network. Internal
> clients point to the gateway box for DNS service, and the gateway goes out
> and resolves DNS queries.
>
> I've also got an ipfw firewall on the gateway. What I'd like to do is
> make it so internal DNS works like it should, but nobody on the outside
> should be able to connect to port 53.sadm@unired.net.pe

Set up your DNS as a forwarder to your upstream provider's nameserver.
Block all inbound traffic on UDP port 53, except from your ISP's
nameserver. Set up your local zone files also.

This still leaves you open to DoS from someone forging your upstream
provider's IP address. But by blocking source routed packets you can
ensure that nobody else can query your nameserver.

g.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Baffling DNS Problem
    ... Narrowed it down to a local DNS problem. ... info Resolving name ok for: ... Gateway Diagnostic ... Could be either gateway or DNS issue action Automated repair: Reset network connection action Disabling the network adapter ...
    (microsoft.public.windowsxp.network_web)
  • Re: Solaris 8 Network Config
    ... where to send packets with ip's on other networks. ... If you have a gateway, it needs to be located on the same net as the ... > and resolv.conf (for DNS) in my ETC directory. ... nameserver 10.1.2.1 ...
    (comp.unix.solaris)
  • Re: newbie lost in trying to setup NAT
    ... Also make sure you have not configured a default gateway on the private ... that sounds correct for the DNS forwarding. ... > be able to resolve both local and Internet names from this server. ...
    (microsoft.public.windows.server.networking)
  • Re: Domain controller not found
    ... The WAN port on the gateway has an IP of 192.168.0.4. ... All internet traffic ... So the 192.168.0.1 is not longer used on any server or workstation? ... It just seems that the DNS ...
    (microsoft.public.windows.server.setup)
  • Re: Problem(s) resolving names with natd/ipfw.
    ... Then set all the clients' primary DNS to ... that of the internal IP of your gateway. ... > The problem is that the Windows XP client CANNOT ... > access the Internet with alphabetic names (should be ...
    (freebsd-questions)