0

I looked about but couldn't find a similar enough question.

I have some remote servers positioned on clients networks, which provide various services (raspberry pi) - and their firewall config is as follows:

Only specific IP addresses INPUT and OUTPUT to specific ports. Everything else is dropped. Key only SSH connections allowed from my own network.

Problem: One of the provided services is an email campaign creator, which send out the campaigns on behalf of the client, so the client has to be able to set the SMTP server of their own email provider.

Until now, I have been doing the setup for them, and setting the server as IP not hostname, then adding the relative rule in iptables. I would like to change this and open 53 for UDP DNS requests as follows:

# DNS Hostname Resolution
/sbin/iptables -A OUTPUT -s $ip -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
#Return Path
/sbin/iptables -A INPUT -d $ip -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT

Are there any security holes I am completely overlooking here? Is there anything I could do to make this safer?

Any advice is appreciated.

Improve this question

2 Answers 2

Reset to default
2

Correct me if I am wrong, but it sounds like you are running an authoritative DNS server for your client's domain, and people will need to be able to query this server from the public Internet. For security, authoritative DNS servers at least have the following settings:

  • Queries for other domains should be ignored or refused
  • There should be rate limiting to limit the number of DNS requests per second from a single IP address, to prevent DNS amplification attacks.

A DNS amplification attack is essentially when an attacker leverages your DNS servers bandwidth to launch a denial-of-service attack on another target. DNS is normally a UDP protocol, meaning it is easy to spoof the source IP address. If an attacker wants to use your DNS server for an amplification attack, they would simply make tons of queries to your server while spoofing the IP address of their target. Your server would end up sending all of the DNS replies to the target, causing a denial-of-service. Limiting the rate at which a single IP address can send queries will mitigate most of these risks.

If I mis-read your post and you are NOT intending to run a DNS server accessible to the public Internet, then you should configure the server to only respond to queries from the specific IP addresses that need to query it.

Finally, you should keep whatever DNS server software you're running up to date. The most popular DNS server software, BIND, has historically had some major security bugs. Running an old version of BIND could open up some serious vulnerabilities on your server.

Improve this answer
3
  • Thanks for the concise explanation of amplification attacks! Actually in this case, despite my best efforts I have not made the question clear enough. The remote server is a raspberry pi placed on my client's networks, it has nothing to do with DNS - but like any device, needs to be able to query a DNS server in order to resolve hostnames to IP addresses, and herein lies the question. If I open port 53 to any destination IP (since my clients will not all be using the same ISP DNS service, will I be risking the security of that raspberry pi... Sorry if this is not clear. :-)
    – asimovwasright
    Mar 13, 2015 at 10:33
  • @asimovwasright Ah, I see. Normally, firewalls are by default already configured to block all incoming traffic but allow outgoing traffic to any port and any destination. Is this not the case on the pi?
    – tlng05
    Mar 13, 2015 at 22:38
  • Yes, I configured the server to drop all traffic except specific ip/port/state incoming and outgoing. I did this to lock the pi down completely, and the security has stood it's ground on many simulated attacks. But opening port 53 for any destination outgoing only would be very useful, so I wanted to know if there are any major holes in that approach?
    – asimovwasright
    Mar 14, 2015 at 7:28
0

It depends, normally you should limit the IP ranges which are allowed to query your DNS server. The reason being that if you allow any IP to query your DNS server using UDP, it might be abused for performing DNS amplification attacks if you are an open resolver.

Improve this answer
1
  • It isn't my DNS server in this case, it would be a ISP defined server for hostname resolution. So am I still at risk? What is a DNS amplification attack?
    – asimovwasright
    Mar 12, 2015 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .