Date: Mon, 27 Jul 1998 11:04:56 +0200 From: sthaug@nethelp.no To: jkb@best.com Cc: j@lumiere.net, freebsd-security@FreeBSD.ORG Subject: Re: ipfw rules to allow DNS activity Message-ID: <25685.901530296@verdi.nethelp.no> In-Reply-To: Your message of "Mon, 27 Jul 1998 00:55:00 -0700 (PDT)" References: <Pine.BSF.3.96.980727005011.23978A-100000@shell6.ba.best.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> Take a look at /etc/rc.firewall:
>
> # Allow DNS queries out in the world
> ipfw add pass udp from any 53 to ${ip}
> ipfw add pass udp from ${ip} to any 53
>
> You will need to enable same setup as above but for tcp for zone
> transfers (someone correct me if I am wrong).
Unfortunately, it's not quite that simple:
- You can't know the source port in zone transfers initiated from your
own name server. It won't be 53 - remember that zone transfers are
performed by a separate program (named-xfer).
- If you use BIND 8, the source port for queries initiated by the name
server itself will *not* be 53 unless you explicitly say so.
Steinar Haug, Nethelp consulting, sthaug@nethelp.no
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?25685.901530296>