http://www.techworld.com/networking/features/index.cfm?featureid=3129 By Ron Nutter Network World January 29, 2007 Our network is protected by a firewall but my predecessor put both the primary and secondary DNS servers that resolve our domains to the outside world outside of the firewall protecting our network. What is the best way to protect our DNS servers from unwelcome visitors?-- Via the Internet. There are several things that you can do to prevent problems. I would recommend putting the DNS servers behind your current firewall and give them a public IP address. When allowing port 53 through the firewall, be sure to allow both TCP and UDP through. I learned this one the hard way the first time I put DNS servers behind a firewall. There were intermittent problems in DNS resolution until both TCP and UDP were allowed through the firewall for port 53. If you put the DNS servers behind your current firewall, I would suggest putting the servers in a different subnet from your server farm or anything else on your network. I would also suggest putting an access control list statement in the switch for the subnet that the DNS servers will be on that doesnt allow traffic from the DNS servers to ingress onto your network and only talk over your Internet connection. Another option is to put the servers on a DMZ connection. Some firewalls allow this with the installation of an additional network card if the firewall you have doesnt have an additional port already available. Another option is to place the DNS servers behind a seperate firewall that isn't connected to your network. In this way, if the firewall and or one of the DNS servers is compromised, your network won't be in any danger since there isn't a direct connection. If you are open to setting up a third DNS server (assuming that you only have two at this point), you can implement yet another protection option. In this type of configuration, both of the forward facing DNS servers are secondary DNS systems. Since the DNS information on this server can't be directly changed, the unauthorized change would only last until the next time the secondary server receives an update from the new master that you have setup. For this to succeed, the master DNS server would not have a public IP address and would be configured to only talk to the secondary DNS servers. The DNS software you're using might allow additional options. For example, Bind 9 can implement a feature called a view that can prevent a DNS server from giving out DNS resolution on domains that the server isn't directly configured to provide information for. This means that the server wont be a public DNS server source that anyone could use. Extra traffic can be "discouraged" from using your DNS servers for domains they aren't serving. _____________________________ Subscribe to InfoSec News http://www.infosecnews.org/mailman/listinfo/isn
This archive was generated by hypermail 2.1.3 : Sun Jan 28 2007 - 23:27:53 PST