[CentOS] Bind Firewall Rules

[nate]

Paul A wrote:
> Correct me if I'm wrong but from my understanding doesn't the new BIND
> randomize outgoing source ports only? - If so then if you have your firewall
> to allow established connections you should be all set.

That's a good point, just tested it out on my firewall, removed
the port 53 option from named.conf and restarted bind and can
still query it internally and externally for it's authoritative domains.

Perhaps my firewall is just less strict than it used to be(migrated
from freebsd to openbsd about a year ago). I don't recall what the
ruleset used to look like. I do recall having to enable that option
years ago else I couldn't query through the firewall.

Still I think caching name servers should be more protected whenever
possible, as this "fix" isn't really a fix it just makes it a bit harder
to determine what the id is.

nate