Firewall Wizards: Re: dns outbound

[Lance Spitzner <spitzner () dimension net>]

On Thu, 13 May 1999, Deepak Vaidya wrote:

> I have gotten a request to allow all clients behind a firewall to have
> unrestricted access to dns servers outside the firewall.  
>
> Can I get help in coming up with pros and cons off doing that.  I tried to
> search the archives but the search page is not working properly.
>
> I am not comfortable in allowing udp packets outbound from all systems.
> If it helps we are using firewall-1.
Personally, I do not see any harm in allowing DNS outbound through the
Firewall (UDP).   However, you should have an internal DNS server that 
everyone is using.  To open DNS outbound on Firewall-1, all you need is

Internal - Any - Domain_UDP - Accept

NOTE:
Make sure you are NOT using the default DNS rules in FW-1 Properties settings.

Lance Spitzner
http://www.enteract.com/~lspitz/papers.html
Internetworking & Security Engineer
Dimension Enterprises Inc