[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FW-1] DNS Question
Title: RE: [FW-1] DNS Question
IMHO and from what i have seen and read so far TCP 53 is used for DNS Zone Transfers while UDP 53 is used for DNS Queries, that is anything BUT DNS Zone Transfers. If you have a DNS Server that acts as a Primary you should permit incoming connections to TCP 53 from specific IP Addresses (that is Secondary DNS etc). Looking at the...
1. Any (Source) DNSServers(Destination) DNS-53(Port) is it TCP or UDP or both as a group? (Question a)
2. DNSServers (Source) Any (Source) DNS-53 (port) is it TCP or UDP or both as a group? (Question b)
I say that you...
Question a.
=========
You do not need incoming TCP 53 unless your DNS Server is configured as a Primary. Incoming UDP 53 will let the world query your DNS Server (acceptable if DNS is configured as Secondary and the Primary goes down, so you need the world query your Secondary DNS) but not *Zone Transfer* your DNS (acceptable IF NOT Primary DNS)
Question b.
=========
If your DNS Server is configured as secondary you need BOTH TCP 53 AND UDP 53 and that is because you need to ZONE Transfer from the Primary (that is not yours) and do DNS queries on other DNS Servers.
You should also AVOID having the world do DNS Zone Transfers from you as well as messing with your Zones because you expose your servers at great risk (DNS Spoofing, DNS poisoning etc). Try to define the IP Addresses that will be permited to Zone Transfer from you (IF DNS Server is Primary). As for the problem i have no idea what goes wrong. Maybe the fact that you are using Win2k is the problem. If you have DDNS (Dymanic DNS) there might be some problems with it (you are using DDNS and your ISP doesn't expect some problems like the problems you have). Maybe it is the SP5 solution you have. I had Win2k for DNS server and had the same problem. I got rid of the stupid Win2k, installed WinNT 4.0 and have NO problems. De-activate DDNS and install plain-good-old DNS (if this can be done... I hope you didn't install Active Directory).
Cheers
Dimitris
-----Original Message-----
From: Don [mailto:[email protected]]
Sent: Thursday, May 02, 2002 3:08 PM
To: [email protected]
Subject: Re: [FW-1] DNS Question
> 53-TCP is used for zone transfer should be secured 53-UDP can be open to
> all. TIP.
This is not correct. Please read my post below.
-Don
> >>>After all the IPSO upgrades and service pack upgrades for our
> >>>Nokia/Checkpoint 4.1 SP5a solution, we started seeing some random
> >>>results with our DNS servers. Sometimes, it would fail on the first
> >>>lookup - but after that it would be ok... my question is simple... for
> >>>the last several years we've had the simple 2 rules for our DNS Servers:
> >>>
> >>>1. Any (Source) DNSServers(Destination) DNS-53(Port)
> >>>2. DNSServers (Source) Any (Source) DNS-53 (port)
> >>>
> >>>The question is simple...are we missing something obvious??? Our DNS
> >>>servers are Windows 2000.
> >>>
> >>When you say DNS-53, do you mean UDP or TCP? You need to allow both in
> >>order for DNS to function properly. Most DNS requests use UDP port 53,
> >>however larger requests use TCP port 53. It may be these larger requests
> >>that are failing.
> >>
> >>-Don
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
