Networks

Ask something
Discussion Locked

Configuring ACL on router for DNS

0 helpful
19 replies

by drsysadmin 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Am configuring a router to allow DNS queries from inside the network to an exterior DNS server. Have opened tcp/udp on port 53, however, DNS resolution is still not occurring. My understanding was that DNS was on port 53. Have tried dynamic DNS (port 2164) and multicast DNS (port 5353 and 5354) as well, still with no luck. Am at a loss as to what port needs to be open on the router to allow DNS queries. Thanks!

19 replies

by cg it

whats the error that shows up in the event viewer under DNS? what exterior DNS server are you trying to contact? a root server? a site within your domain DNS server? what resolution is not taking place? a name to ip? an ip to name? MX? alias?

more information is needed.

by cg it

also what router? are you using a Cisco Access router, a consumer level router, Symantec Gateway Server, RRAS server? are you running a proxy server? ISA server, a firewall service?

by kenv

There is a free tool called Active Ports (simple to find using google etc.) that will help you determine which port is being used. One question I had was are you sure it's the router causing the DNS resolution failure? Have you configured the pc to go to the external server? Might be an obvious step but had to ask.

by drsysadmin

OK, the problem is that internal network machines cannot do standard DNS (Name resolution to IP) lookups to an exterior, data line provider DNS server (Bellsouth). In effect, it stops all network clients from accessing the internet since no name resolution occurs. Since I am writing my ACL, here is what occurs. I include port 53 as PERMITted for udp and tcp from ANY to my IP and subnet class. I have also tried to PERMIT tcp and udp from any to any on port 53 - still no joy.
Now, without the ACL in place - all the machines on the network are able to succeed with DNS queries - ie- my users have the internet. However, I need the ACL in place for obvious security reasons. When no ACL is in place - all ports are open. So what I need to know is what port I am inadvertantly closing (due to the implicit deny any any statement at the end of an ACL) so that I can PERMIT the appropriate port/ports to allow my users to do DNS name to IP resolution.

Note that I am running a Cisco 1700 Series router. While I do have other security devices running, as soon as I take the ACL off the router interface everything goes back to working fine, so the problem has to be the ACL I have applied. If the problem was somewhere else, it wouldn't appear/disappear with the application and removal of the ACL on the router.

Thanks.

by cg it

hate to say this but you still haven't given us proper information. the access control list your creating is for what? for the cisco 1700 series access router? are you using the access-group command, if in fact your creating the access control list for the 1700? what does "show access-lists" show when use that command line statement for the 1700 access server?

might be the routing protocol not converging within the routing domain or a misconfigured extended access control list. the later if hosts cant can't access services beyond the lan [textbook Cisco troubleshooting stuff].

an ACL in a Windows environment applies to access to resources in that environment. and ACL on a Cisco router is a whole different thing.

again which one you creating?

by cg it

my advise is to get your hands on config maker 2000 and use that to configure the Cisco 1700.

by drsysadmin

Poster rated this answer.
Attempted - config-maker drew up an access list similiar to mine - tried utilizing it - blasted thing still didn't work. The idea was sound - and appreciated - just didn't fix the problem.

by drsysadmin

OK - the ACL is on the cisco Router - specifically my external interface (T1). Its function is security - filtering incoming packets coming into my router for transmission to my network. I am using an extended ACL since I am filtering by protocol, source (which is "any"), destination and port #. Specifically, all ACL statements are permits for tcp or udp from "any" to my network on specific ports since at the end there is an implicit deny any any. This ensure that ONLY what I want to come in, can do so. Standard stuff - ports 80, 443, 25, and 110 are permitted since I am allowing web and email to connect. However, DNS functions operate on a different port. My previous experience has been DNS requires port 53 - but allowing TCP and UDP through on port 53 still does not allow for internal network clients to utilize an external, bellsouth DNS server for name to ip resolution.

As for how the access-list is created -
in config from terminal - global config prompt

access-list 101 permit tcp any 99.99.99.0 0.0.0.255 eq 80
access-list 101 permit udp any 99.99.99.0 0.0.0.255 eq 80

same thing for all the other ports - including 53
each port has 2 entries - one for TCP, one for UDP

once the complete access-list 101 has been input -it is applied on the appropriate interface using the standard command of:

ip access-group 101 in

As soon as I do this - the internet ceases to exist for my internal users. I then have to

no access-list 101

to restore the connection of my users to the internet. Any internal machine fails in trying to ping or nslookup an exterior name - such as yahoo.com - meaning DNS is the issue. Since there is no filter on the router for traffic going OUT, the problem is that the DNS response is not coming through the interface and back to the requesting machine.
Ideas?

by cg it

run the command show access-lists . in the access lists your group list 101 permit tcp any host eq 53 or 101 permit udp any host eq 53 should be in the list. since you have disabled the access list with the command no ip access-group 101 and you get connections, yeah the problem is in the access list. do you have an in access list 101 and an out access list 101 or no statement so the list applies for both directions? the list is read top to bottom so somewhere in there is the offending rule.

by cg it

ah found it you put the access list on the ethernet interface with the in but you didn't apply one for out. the in at the end applies the access list for inbound only and you need one for out or don't put the in at the end of the command statement which will make the list apply for both directions.

by cg it

hope you followed that. to recap after you created your access list and then went to apply it to the ethernet interface you put "in" at the end of the statement ip access-lists 101 "in" and that makes the list apply only for inbound. you don't have a corresponding "out" access list. so you can do one of 2 things. create an out access list and apply it to the interface of apply the access list without any "in"/"out" at the end which would then apply the access list for traffic in both directions.

by cg it

rusty with Cisco stuff so sorry for all the banter on DNS, ACL, etc. I mostly deal with Windows network junk so took a wee bit more to catch on that the DNS issue with ACLs were for your 1700 access router.

by cg it

it is my understanding that there is an implicit deny if not allowed. so with an in access list and the absence of an out list out traffic would be denied.

I'm rusty with cisco stuff so but thats my understanding with ACLs .

by drsysadmin

The ACL is not going onto my Ethernet0 (local) interface - the ACL is applied to SERIAL0 - the WAN interface. The ACL is applied "in" - so its filtering packets coming IN to the network through Serial0. As long as I do not apply an ACL "out", all traffic is permitted outgoing. I have no ACL at all on Ethernet0, nor do I have an outbound ACL on Serial0. The only filter being applied is "IN"coming from the internet, through Serial0, then permitted into my network.
Here is the ACL in total:

access-list 101 permit tcp any 99.99.99.99 0.0.0.255 eq 80
access-list 101 permit udp any 99.99.99.99 0.0.0.255 eq 80
access-list 101 permit tcp any 99.99.99.99 0.0.0.255 eq 25
access-list 101 permit udp any 99.99.99.99 0.0.0.255 eq 25
access-list 101 permit tcp any 99.99.99.99 0.0.0.255 eq 53
access-list 101 permit udp any 99.99.99.99 0.0.0.255 eq 53
access-list 101 permit tcp any 99.99.99.99 0.0.0.255 eq 110
access-list 101 permit udp any 99.99.99.99 0.0.0.255 eq 110
access-list 101 permit tcp any 99.99.99.99 0.0.0.255 eq 443
access-list 101 permit udp any 99.99.99.99 0.0.0.255 eq 443
access-list 101 permit tcp any 99.99.99.99 0.0.0.255 eq 1701
access-list 101 permit udp any 99.99.99.99 0.0.0.255 eq 1701

this is applied via:
ip access-group 101 in

Which kills the internet.
have also tried the same setup with:

access-list 102 permit IP any any
ip access-group 102 out

No change.
Your right, there is an implicit deny statement on the end of every ACL, which is why the port must be manually opened.

by drsysadmin

Closing closing and moving to Network Security. Assistance appreciated, but after review the other area's may be more appropriate for the subject matter. Hopefully a resolution will be found - its likely something obvious I am missing.
Thanks for the attempts.
Dr. Sys

This discussion is closed to new replies.