IP Filtering and DNS Problem...

[Mohammad]

Dear All,
For security reason I enabled TCP/IP Filtering in win2k
server.
my setting permit only 53,80 ports on tcp and 53 on udp.
Now on server I can not resolve any domain name...
which port(s) I must to permit for commonication?

Suggestion Please...

Regards Mohammad

 

[Jonathan de Boyne Pollard]

M> which port(s) I must to permit for commonication?

<URL:http://homepages.tesco.net./~J.deBoynePollard/FGA/dns-shaped-firewall-holes.html>

 

[Herb Martin]

For security reason I enabled TCP/IP Filtering in win2k

server.
my setting permit only 53,80 ports on tcp and 53 on udp.
Now on server I can not resolve any domain name...
which port(s) I must to permit for commonication?

53 using UDP and TCP (both) covers DNS so something
else is wrong.

 

[Ace Fekay [MVP]]

In

53 using UDP and TCP (both) covers DNS so something
else is wrong.

Actually you'll unfortunately need those dynamic ports opened too that
Windows uses, that BIND doesn't use. 1024-65534., unless there is something
else configured that's not mentioned, such as that the forwarders are
configured properly, he's only pointing to his own server, what direction
opened, who is the source and who is the destingation ports configured in
IPSec filters, etc.

If pointing to his DNS, and the filters allow internal Windows machines to
access it with those wide ports, and the filters are allowing two way
communication from the destination DNS (the Forwarder) to itself, and
reverse, then I wouldn't see a problem. If the filtering is just to the
external DNS, and not taking in consideration access from the clients, well,
that could be a problem too. If this is happening soley on the server, then
either the wide range is not opened and/or in the wrong direction or only in
one direction.

I find it easier to use a firewall. IMHO, TCP filtering is overhead on the
machine. I would rather the firewall handle the traffic. On the firewall,
(depending on the brand), allow all "Established" for internal to outside
resources and the response to come in, and block all incoming (or just allow
what is needed to come in, if running any services).

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Ace Fekay [MVP]]

In

If he opens where 53 is either the destination or
the source he will be fine.

Obviously if he doesn't specify a constant client
port for the requesting side, he can't deal with
a random client.

He must either use "any" on one side of each filter
or speciy the client port in his DNS setup.

Agreed.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Ace Fekay [MVP]]

In

How do you specify the "client" Port in MS DNS?

Is there a registry setting (a la RPC has)?

It's easy in BIND but seldom needed.

Yes, a reg entry.

SendPort for DNS:
http://www.microsoft.com/windows200...2000/techinfo/reskit/en-us/regentry/95408.asp

But, the latest SPs fix this issue below:

260186 - SendPort DNS Registry Key Does Not Work as Expected:
http://support.microsoft.com/?id=260186



--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

 

[Jonathan de Boyne Pollard]

AF> Actually you'll unfortunately need those dynamic ports opened
AF> too that Windows uses, that BIND doesn't use.

Whether BIND uses them depends from the version. Version 9 does.

<URL:http://homepages.tesco.net./~J.deBo...ll-holes.html#ExternalProxyViaForwardingProxy>

 

[Herb Martin]

AF> Actually you'll unfortunately need those dynamic ports opened

AF> too that Windows uses, that BIND doesn't use.

Whether BIND uses them depends from the version. Version 9 does.

Bind 9 uses them by default but it is trivial to set a
fixed port.

Presumably one can do the same in MS DNS as
Ace indicated.