IMHO and from what i have seen and read so far TCP 53 is used
for DNS Zone Transfers while UDP 53 is used for DNS Queries, that is anything
BUT DNS Zone Transfers. If you have a DNS Server that acts as a Primary you
should permit incoming connections to TCP 53 from specific IP Addresses (that
is Secondary DNS etc). Looking at the...
1. Any (Source)
DNSServers(Destination) DNS-53(Port) is it TCP or UDP or
both as a group? (Question a)
2.
DNSServers (Source) Any (Source) DNS-53
(port) is it TCP or UDP or both as a group? (Question b)
I say that you...
Question a.
=========
You do not need incoming TCP 53 unless your DNS Server is configured as
a Primary. Incoming UDP 53 will let the world query your DNS Server
(acceptable if DNS is configured as Secondary and the Primary goes down, so
you need the world query your Secondary DNS) but not *Zone Transfer* your DNS
(acceptable IF NOT Primary DNS)
Question b.
=========
If your DNS Server is configured as secondary you need BOTH TCP 53 AND
UDP 53 and that is because you need to ZONE Transfer from the Primary (that is
not yours) and do DNS queries on other DNS Servers.
You should also AVOID having the world do DNS Zone Transfers
from you as well as messing with your Zones because you expose your servers at
great risk (DNS Spoofing, DNS poisoning etc). Try to define the IP Addresses
that will be permited to Zone Transfer from you (IF DNS Server is Primary). As
for the problem i have no idea what goes wrong. Maybe the fact that you are
using Win2k is the problem. If you have DDNS (Dymanic DNS) there might be some
problems with it (you are using DDNS and your ISP doesn't expect some problems
like the problems you have). Maybe it is the SP5 solution you have. I had
Win2k for DNS server and had the same problem. I got rid of the stupid Win2k,
installed WinNT 4.0 and have NO problems. De-activate DDNS and install
plain-good-old DNS (if this can be done... I hope you didn't install Active
Directory).
Cheers
Dimitris
-----Original Message-----
From: Don
[mailto:[email protected]]
Sent: Thursday, May 02, 2002 3:08 PM
To: [email protected]
Subject: Re: [FW-1] DNS Question
> 53-TCP is used for zone transfer should be secured 53-UDP
can be open to
> all. TIP.
This is not correct. Please read my post below.
-Don
> >>>After all the IPSO upgrades and service pack
upgrades for our
> >>>Nokia/Checkpoint 4.1
SP5a solution, we started seeing some random
>
>>>results with our DNS servers. Sometimes, it would fail on
the first
> >>>lookup - but after that it
would be ok... my question is simple... for
>
>>>the last several years we've had the simple 2 rules for our DNS
Servers:
> >>>
> >>>1. Any (Source)
DNSServers(Destination) DNS-53(Port)
> >>>2. DNSServers
(Source) Any (Source) DNS-53 (port)
> >>>
>
>>>The question is simple...are we missing something obvious???
Our DNS
> >>>servers are Windows
2000.
> >>>
>
>>When you say DNS-53, do you mean UDP or TCP? You need to allow both
in
> >>order for DNS to function properly.
Most DNS requests use UDP port 53,
>
>>however larger requests use TCP port 53. It may be these larger
requests
> >>that are failing.
> >>
>
>>-Don
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set
fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please
see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================