Windows Forum

Ask something
Discussion Locked

TCP/IP Filtering Stops DNS

0 helpful
13 replies

by max98037 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a very vexing DNS/Packet filtering problem.

I have a Windows 2000 DNS server with AD integrated zones. And when I use TCP/IP filtering on the network adapter and permit port 53 UDP and 53 TCP, my workstations arent able to get DNS. (They are unable to resolve names, they can ping by IP adress)
Though if I allow all UDP, suddenly everyone has DNS. Which ports am I missing here?

If anybody has a suggestion, it would save a great deal of further hair from being uprooted from my head in frustration:)

Thanks!

13 replies

by jailbreak_pt

Hi

It dependes on what your are using on your network/workstations.
If you select Permit Only in UDP Ports, TCP Ports, or the IP Protocols column and the lists are left blank, the network adapter will not be able to communicate with anything over a network, either locally or to the Internet.

Maybe this help. Try to read this article from microsoft and the related links
http://support.microsoft.com/default.aspx?scid=kb;en-us;179442

But remember that TCP/IP filtering it only affects inbound traffic. It does not block outbound. It also does not block ICMP

And try this also.
http://www.jsiinc.com/SUBL/tip5700/rh5799.htm

any other help just ask

by max98037

Thanks for your help but I have not left the columns blank, which is what makes this problem vexing.

To help clarify what I stated in my original post:
I have in fact opened port 53 TCP and UDP (by adding 53 to both the TCP and UDP columns), yet still am not servicing DNS requests. Any further suggestions?

by max98037

Did you read my post?
I did read the articles. They detail the use of Windows 2000 TCP/IP filtering, which I am quite familiar with. What I dont understand is why even after allowing port 53, I am not able to serve DNS. I am able to permit other services, the problem is only with DNS.
I found no mention of this issue in the articles.

by mikex

TCP/UDP Port 53
Common Use

DNS Service is typically used to convert between URL's and IP Addresses.

If you're dissabling this ports it's obvious why you don't have a DNS services/Internet.

If you're looking for something like that - this is another question:

It's possible to configure DNS servers to answer queries from local hosts differently than external queries so that local clients will receive the internal server's address during name resolution. They will then connect directly to the local server, and the firewall isn't involved at all. This reduces local traffic since packets don't have to be sent through the firewall.

by jailbreak_pt

Hi again

I ask you again.
Did you realy read the articles and the other links??
If so try to read again.
There?s he answer for your problem.

by curlergirl

I think the problem is that the clients use any UDP port above 1023 for the initial DNS query. It is sent TO port 53 on the server, but FROM any high port on the client. The server then responds to whatever port on the client was originally used to send the query. So, it will work if you allow UDP on all ports above 1023 only (in other words, you can block UDP on ports below 1023 if you want), but it won't work otherwise.

Hope this helps!

by smight

Dude, I know exactly what you are talking about. I was playing with TCP/IP filtering myself and I came accross this thread when searching for the answer myself. Here is what I found out:

FYI: TCP/IP filtering is not for firewalling but only for filtering INCOMING packets. See Microsoft KB816792.

I used the Netowrk Monitor to trace the UDP packets and figure out what is happeneing with DNS.

The DNS client service binds to a random high source port. I had a W2003 server set to use my ISP's DNS on the NIC and repeated DNS queries using nslookup would send UDP packets to the ISP's DNS server from SOURCE port 3106 (or something like that) to DESTINATION port 53. Then the ISP's DNS server would reply from SOURCE port 53 to DESTINATION port 3106 for example.

This explained why my TCP/IP filtering was breaking DNS. I was only accepting incomig packets on UDP port 53 but the actual incoming packets were destined for port 3106, for example.

After lots of research I could not figure out a way to cause the DNS client service to use a specific UDP port. However, I could tell the DNS server service to use a specific port. Here is what I did:

Install the W2003 DNS server, set my NIC to use my own IP for DNS queries and then set my DNS server service to forward to my ISP's DNS server. Now the DNS client service still uses a random UDP source port to ask my own internal DNS server for DNS resolution. AND the DNS server uses a different random UDP port to ask my ISP's DNS server for resolution. However, check out Microsoft KB260186. I tried this on my W2003 server and it worked.

by smight

>Answer continued from previous post>

I set: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\SendPort

Value type: REG_DWORD
Value in decimal: 53

and my DNS server service started using UDP 53 as the source port. (You have to restart the DNS server service after making the reg change.) Packet traces confirm that the UDP queries now use source port 53 and destination port 53 for resolution. Therefore the incoming responses are returning and connecting to UDP port 53 so the TCP/IP filtering no longer breaks DNS.

However, I still did not like this solution because I am not hosting DNS so I don't want to listen for INBOUND DNS queries since I would then be vunerable to several DNS exploits. Therefore, I set my SendPort value to some obscure DNS value and changed my TCP/IP filtering to match. It still works and I am happier with my security.

Hope my experience helps you as well.

Thanks,
Chris Britt

by smight

Oops, sorry. In the last paragraph of my comment I meant to say that...

"I set my SendPort value to some obscure port value and changed my TCP/IP filtering to match that port. It still works..."

Good luck.
Chris

by smight

Hey I was thinking about my post and I think it is not a good idea potentially. I would be willing to bet a cheeseburger that Microsoft set the DNS services to bind to random ports so that multiple simultaneous DNS queries will be servicable at the same time. In my case I set DNS to always use the same port so that I could filter on that port. However, my server is hosting a single service on the Internet and will require very infrequent DNS resolutions. However, if your server is doing DNS for client machines on your network then you will have lots of DNS queries and I think that if you set your DNS to use only 1 port that you may have some overlapping queries that will either time out or you will get some wierd results.

TCP/IP filtering is the poor man's firewall and I am only doing this short term. I plan to put this server behind a real firewall as soon as it gets moved to the co-lo facility. A PIX or even an ISA firewall would be good. The best way to secure the server would be to use a firewall that restricts to only allow DNS queries on the UDP packets but would allow for dynamic ports. An ISA firewall with further inspect the DNS packets for exploits. And then you could even use ACLs to restrict DNS triffic to only go back and forth between your server and your ISP's DNS servers. This is a much safer way to secure the UDP ports and it is also more reliable since you can still use dynamic port allocation on the server if you have it behind a good firewall.

Anyway, I obviously don't know all the details of your situation, so don't take this as criticism of any kind. I am just throwing my 2 cetns in.

Chris

by sean_worthington

I just solved this problem on my own w2003 server. I opened up all UDP ports on the packet filter and it works. I closed my tcp port 53 (and all other TCP ports for that matter. TCP ports don?t seem to matter with the outbound DNS. I also disabled printer and file sharing and disabled netbios over TCP/IP.

I port scanned myself with shields up. It wasn?t pretty but it was much better than I expected and no obvious vulnerabilities.

I could have installed DNS server but that?s just more overhead. After I access the internet and download my patches, I am going to close all UDP ports too.
Sean

This discussion is closed to new replies.