Re: Help with ipfw rules to allow DNS queries through

From: Dave Raven (dave@kill-9.za.net)
Date: 12/26/01 

From: "Dave Raven" <dave@kill-9.za.net>
To: <security@FreeBSD.ORG>, <xphilius@yahoo.com>
Date: Wed, 26 Dec 2001 22:32:51 +0200

The first line should be left in my opinion. Later versions of Bind (e.g)
have been using tcp more and more.

I assume your running bind (named). so add Thomas' firewall rules and look
into this
for bind (check /etc/namedb/named.conf) rather:

acl lan {
                192.168/16 ;
                127.0.0.1 ;
           } ;

options {
        directory "/etc/namedb";

        query-source port 53;

        allow-query { any ; } ;
        allow-recursion { lan ; } ;
        allow-transfer { lan ; } ;
};

query-source dictates the port to use when originating queries etc. ; this
will help your firewall.
         (more in the named.conf file).
allow-query to any will allow all people to query your server (if you intend
to host dns you need this).
recursion and transfers will only be allowed to 192.168.*.* and localhost.

Dave.
OpteqSec.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Crash w/FreeBSD 4.9 and BIND 9.2.3
    ... There weren't any logs that I could see. ... When I had somebody reboot it for me, ... > I'm not even sure BIND is the reason for the crash. ... > because the problem didn't begin until I started running BIND the other ...
    (comp.unix.bsd.freebsd.misc)
  • Re: DNS
    ... >> TCP for zone transfer. ... yes (if the server is bind). ... > overflows the UDP packet size, the query is retried with TCP. ... This is just how bind works. ...
    (comp.os.linux.security)
  • Re: High CPU usage after installing ISC BIND ver 9.3.1.
    ... These two DNS ... replacing the old WINS servers. ... All the migration and BIND installation are ... Why are you running BIND when Windows Server has its own ...
    (microsoft.public.windows.server.dns)
  • portsentry core dumps on 5.2.1
    ... atempts to bind to a tcp or udp port the first one listed in the ...
    (freebsd-questions)
  • Re: Intel Itaniums very survival in doubt - inquirer article
    ... > Then if the applications spent any significant time in the OS code (rather ... one of the bind tuning examples includes some "top" numbers ... for HP-UX systems just running bind and nothing else. ... show that the ratio of kernel to user is roughly 60% kernel ...
    (comp.os.vms)