Re: Does blocking TCP DNS packets keep your Bind safe?

[Bill_Royds () pch gc ca]

Don Kendrick said:
     2. Most if not all "normal" queries needed by legit Internet traffic are
UDP.

This is not at all true. Nowadays, requests for DNS over TCP for large reverse
DNS lookups are very common. If you have a firewall that is verifying DNS for
logs etc. you will have a large number of TCP DNS lookups for multi hosted web
farms etc.

You can still block it, but you may miss a lot of useful information in a
security context.





Don Kendrick <don () netspys com> on 03/07/2001 04:09:01 PM
                                                              
                                                              
                                                              
 To:      firewall-wizards () nfr net                            
                                                              
 cc:      (bcc: Bill Royds/HullOttawa/PCH/CA)                 
                                                              
                                                              
                                                              
 Subject: [fw-wiz] Does blocking TCP DNS packets keep your    
          Bind safe?                                          
                                                              





OK, here I go again breaking things :)

Over the years I've argued about blocking icmp at the border routers. Steve
Bellovin et al would usually argue that it breaks path MTU, etc. I'd
usually argue that we can rely on path MTU being negotiated elsewhere in
the path (LAN vs. WAN bandwidth)...but I digress

Here's what I am suggesting:

1. We should all only do zone transfers (TCP) with known secondaries.

2. Most if not all "normal" queries needed by legit Internet traffic are UDP.

Why not just block port 53 TCP connections at the border routers except for
our secondaries. Is it possible to do a buffer overflow or other DNS/Bind
exploit via UDP? I don't know the answer, I'm asking.

Don



Don Kendrick, CNE, CCNA, GCIA, CISSP





_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards