Johnny Hughes wrote: > John Hinton wrote: >> OK, so does anybody have a good firewall rule solution for what we're >> supposed to be doing with bind these days? Obviously port 53 is no >> longer enough. >> > > how do you mean? > > opening port 53 in is still enough ... the outbound port is what is > randomized > > not sure what kind of problems you are encountering I'm trying to pass the test on DNSstuff.com. These are my firewall rules for bind Accept If protocol is TCP and destination port is 53 and state of connection is NEW Accept If protocol is UDP and destination port is 53 and state of connection is NEW from my gui or -A RH-Firewall-1-INPUT -p tcp -m tcp -m state --dport 53 --state NEW -j ACCEPT -A RH-Firewall-1-INPUT -p udp -m udp -m state --dport 53 --state NEW -j ACCEPT from iptables. I have upgraded bind, but when I remove this line from a config file, bind will not restart. query-source address * port 53; From what I read, the above line is supposed to be removed. My tests from outside states that I am vulnerable to cache injections. "*Based on the results, a DNS server is vulnerable if:* The IPs /AND/ the Query source ports match or the query IDs match. Matching query source ports or query IDs make it easier to spoof fake results to the DNS server, poisoning its cache." The IDs in the testing change, but the port stays the same. I read where the firewall rules need to be fixed due to this change, but firewalls have never been my strong point. I have a pretty darned good understanding of bind..... but firewalls, not so much. John > > ------------------------------------------------------------------------ > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos >