Date: Wed, 26 Dec 2001 22:32:51 +0200 From: "Dave Raven" <dave@kill-9.za.net> To: <security@FreeBSD.ORG>, <xphilius@yahoo.com> Subject: Re: Help with ipfw rules to allow DNS queries through Message-ID: <00cb01c18e4c$7f60e600$3800a8c0@DAVE> References: <20011226194513.76507.qmail@web11801.mail.yahoo.com> <00ea01c18e4b$19edf0c0$3028680a@tgt.com>
next in thread | previous in thread | raw e-mail | index | archive | help
The first line should be left in my opinion. Later versions of Bind (e.g)
have been using tcp more and more.
I assume your running bind (named). so add Thomas' firewall rules and look
into this
for bind (check /etc/namedb/named.conf) rather:
acl lan {
192.168/16 ;
127.0.0.1 ;
} ;
options {
directory "/etc/namedb";
query-source port 53;
allow-query { any ; } ;
allow-recursion { lan ; } ;
allow-transfer { lan ; } ;
};
query-source dictates the port to use when originating queries etc. ; this
will help your firewall.
(more in the named.conf file).
allow-query to any will allow all people to query your server (if you intend
to host dns you need this).
recursion and transfers will only be allowed to 192.168.*.* and localhost.
Dave.
OpteqSec.
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00cb01c18e4c$7f60e600$3800a8c0>