RE: What UDP port to open to enable w2k server to surf the web us ing domain names

From: Matthew.van.Eerde@hbinc.com
Date: 03/14/02 

From: Matthew.van.Eerde@hbinc.com
To: TurnerL@tea-emh1.army.mil, joseph_tan01@pacific.net.sg, alex@towerrecords.com, KWilliams@sark.com, pnolan01@nycap.rr.com, focus-ms@securityfocus.com
Date: Thu, 14 Mar 2002 11:40:37 -0800

If a DNS client asks a DNS server a question, the setup is this:

client:high -> server:53

The response is then
server:53 -> client:high

This doesn't work with IP filtering (you can't filter on the source port)
and you wouldn't want to anyway as there are any number of ways for a hacker
to set a source port.

A proposed solution: Install DNS Services on the machine. Don't host any
zones, just have it be caching-only. Set the IP properties to use 127.0.0.1
as the DNS server. The setup will then be:

127.0.0.1:high -> 127.0.0.1:53 (initial question to the DNS service)
webserver:53 -> rootserver:53 (DNS service looks it up)
rootserver:53 -> webserver:53 (Answer comes back in)
127.0.0.1:53 -> 127.0.0.1:high (Answer is relayed to process that needed it)

This should work through IP filtering as 127.0.0.1 is not filtered. (is it?)

> -----Original Message-----
> From: Turner, Keith [mailto:TurnerL@tea-emh1.army.mil]
> Sent: Thursday, March 14, 2002 08:26
> To: 'Joseph Tan'; Zimin, Alex; 'Williams, Kevin'; 'Patrick Nolan';
> focus-ms@securityfocus.com
> Subject: RE: What UDP port to open to enable w2k server to
> surf the web
> us ing domain names
>
>
>
> UDP does not work well with TCP/IP filtering. I've ran into
> the same thing
> you have - my solution was to setup a hosts file for the few
> domain names I
> needed to resolve. UDP is connectionless, so Win2k does not
> recognize that
> the answer from the DNS server, on a random high numbered
> port, is an answer
> from the request you sent out a split second ago.
>
> Keith
>
>
> -----Original Message-----
> From: Joseph Tan [mailto:joseph_tan01@pacific.net.sg]
> Sent: Thursday, March 14, 2002 11:07 AM
> To: Zimin, Alex; 'Williams, Kevin'; 'Patrick Nolan';
> focus-ms@securityfocus.com
> Subject: What UDP port to open to enable w2k server to surf the web
> using domain names
>
>
> hi all
>
> I have a question and hope that something can advise me.
>
> I have a w2k web server and have TCP/IP filtering enabled.
> When I permit
> only TCP 80, 443 and UDP 53 to pass through,
> my web server cannot access the web using domain name. Ping
> IP address is
> sucessful whereas ping domain names failed.
>
> But when I permit UDP all, I can surf the web using domain
> names withou any
> problem. So the question is which UDP port do I need to open
> to enable my
> w2k web server to access the web? I thought UDP 53 should be
> good enough.
>
> regards
>
> Joseph
>

Relevant Pages

  • Re: DNS/port filter prob on Win2k webserver
    ... the connection and realize that inbound traffic to the above 1024 unprivileged port ... Ipsec filtering can be used to manage udp traffic in your ... > should use the forwarder configured to the master BIND DNS server for domain ...
    (microsoft.public.win2000.general)
  • Re: DNS/port filter prob on Win2k webserver
    ... the connection and realize that inbound traffic to the above 1024 unprivileged port ... Ipsec filtering can be used to manage udp traffic in your ... > should use the forwarder configured to the master BIND DNS server for domain ...
    (microsoft.public.win2000.dns)
  • Re: DNS/port filter prob on Win2k webserver
    ... the connection and realize that inbound traffic to the above 1024 unprivileged port ... Ipsec filtering can be used to manage udp traffic in your ... > should use the forwarder configured to the master BIND DNS server for domain ...
    (microsoft.public.win2000.networking)
  • Re: TCP/IP Filtering Problem
    ... Unlike tcp/ip filtering for TCP, filtering for UDP is not "stateful" in that the ... dns name resolution FROM your server. ... I have it set so that the following TCP ports are ...
    (microsoft.public.win2000.security)
  • Re: The revised DNS.EXE that was released in response to MS08-037
    ... Further reading suggests the 2500 UDP server ports that the DNS server is ... Why would Microsoft need to pre-allocate UDP server ports in order to do UDP ...
    (microsoft.public.windows.server.dns)
Quantcast