1

This question might be simple but please understand my lack of knowledge.

I am seeing a lot of DNS packets dropped by our firewall (sophos SG125) by default rule 60001.

There are three Domain Controllers 10.0.0.1 - 3. Workstations have 10.0.0.1 for their DNS preferred server.

When our internal DNS server receives DNS queries from domain computers, obviously it sends to ISP forwarders e.g. 111.111.111.111 and 111.111.111.222.

In our firewall, we have a outbound firewall rule that allows DNS packets to the ISP forwarders. There is no inbound rule for allowing DNS packets from ISP or any IPs. So all UDP DNS answers from ISP get dropped I think. But users are still able to browse Internet so this means the DCs are able to resolve domain names even though responds were blocked by firewall.

Do I have to open DNS port for the ISP DNS forwarders?

1

If you do not have internal DNS servers, or have internal DNS servers that forward all the queries (DNS caches), you do not need to create DNS rules the other way (e.g. rules for the inside).

The Firewall builds an internal table, that will accept in the way in the answers to the internal requests that were allowed to get out by your defined rules/policies. The technology that allows this is called "stateful Firewall", and is pretty much ubiquitous nowadays. Cisco, Checkpoint, iptables have implemented it for ages now.

In computing, a stateful firewall is a network firewall that tracks the operating state and characteristics of network connections traversing it. The firewall is configured to distinguish legitimate packets for different types of connections.

What do you need to change, is that DNS do not only works in UDP, but also in TCP. So besides port 53/UDP, you have to allow port 53/TCP out.

Not doing that can cause you problems with some operations in the Internet, as DNS can fall back for TCP for giving longer answers.

From Is it true that a nameserver have to answer queries over TCP?

TCP is not just for zone transfers. DNS server implementations are now "required" (in so much as any RFC requires anything) to support TCP, per RFC 5966, "DNS Transport over TCP - Implementation Requirements". That said, if your particular DNS servers are not configured to support TCP, or if it is blocked, then the longer term effect will be an inability to support DNSSEC correctly. Similarly any other DNS data which causes responses to exceed 512 bytes might be blocked.

As for DNS packets dropped that are dropped in the way in, after you have the TCP rule, they are scanning tries. Ignore them. As for other dropped DNS packets to IPs that are not your DNS forwarders, definitively ignore them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.