From owner-freebsd-security  Wed Dec 26 12:36: 0 2001
Delivered-To: freebsd-security@freebsd.org
Received: from chaos.evolve.za.net (chaos.evolve.za.net [196.34.172.107])
	by hub.freebsd.org (Postfix) with ESMTP id 29C0A37B419
	for <security@FreeBSD.ORG>; Wed, 26 Dec 2001 12:35:51 -0800 (PST)
Received: from DAVE ([192.168.0.56])
	by chaos.evolve.za.net (8.11.6/1.1.3) with SMTP id fBQKZhC97836;
	Wed, 26 Dec 2001 22:35:43 +0200 (SAST)
	(envelope-from dave@kill-9.za.net)
Message-ID: <00cb01c18e4c$7f60e600$3800a8c0@DAVE>
From: "Dave Raven" <dave@kill-9.za.net>
To: <security@FreeBSD.ORG>, <xphilius@yahoo.com>
References: <20011226194513.76507.qmail@web11801.mail.yahoo.com> <00ea01c18e4b$19edf0c0$3028680a@tgt.com>
Subject: Re: Help with ipfw rules to allow DNS queries through
Date: Wed, 26 Dec 2001 22:32:51 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

The first line should be left in my opinion. Later versions of Bind (e.g)
have been using tcp more and more.

I assume your running bind (named). so add Thomas' firewall rules and look
into this
for bind (check /etc/namedb/named.conf) rather:

acl lan {
                192.168/16 ;
                127.0.0.1 ;
           } ;

options {
        directory "/etc/namedb";

        query-source port 53;

        allow-query { any ; } ;
        allow-recursion { lan ; } ;
        allow-transfer { lan ; } ;
};


query-source dictates the port to use when originating queries etc. ; this
will help your firewall.
         (more in the named.conf file).
allow-query to any will allow all people to query your server (if you intend
to host dns you need this).
recursion and transfers will only be allowed to 192.168.*.* and localhost.

Dave.
OpteqSec.



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message