B) As soon as we type in google.com we get an output showing the server and an IP-address#port. This server is basically the current DNS server that will be serving our request. In this case it is 10.0.1.1 and the port no is 53. This is because DNS uses UDP port 53 to serve its requests.
We are using Dynamic DNS to access our site and the modem/router differentiates via port forwarding what server the query goes to based on the port number ie all request go to abc.dyndns.org:port number. Based on the port eg. Port 3389 goes to server1 (192.168.0.1), port 8080 goes to server 2(192.168.0.2), port 80 goes to server 3 (192.168.0.3).

Active6 years, 6 months ago

Locking down an application server. The server hosts a web app that is served via http. There are a few other ports open as well.

Port 53 is open for DNS. Why would I need this?

Host Port Flags Age Type Address(es) ping vrf my_vrf 192.168.1.100 Type escape sequence to abort. (=assuming this disabled dns lookup in the global vrf only) ip domain lookup vrf IT source-interface Loopback0 (Lo0 = part of vrf IT). I am connected to the router via the Gi0/0 interface (so via Mgmt-vrf). Don't know if this makes a difference. When these devices attempt to do a name lookup, it hits my router and my router decides if it wants to answer the question locally or pass the request along to the real DNS external server. When you add port 53 to your port forward list, this all breaks. Why dig to router is on DNS 53 port? Ask Question 0. 192.168.1.1 is my router NetGear. But in your dig command you specified to use TCP with +tcp, and since the router is only listening on UDP, the request fails. To resolve the issue. Nslookup does a DNS lookup. Thus they both use Port 53. As to your real question, which is.

Extra: (Do not need to answer this but...) Would this command open that port using iptables in Linux

csi

csicsi

6806 gold badges15 silver badges35 bronze badges

5 Answers

Port 53 is open for DNS. Why would I need this?

You need to have UDP 53 allowed for responses to DNS queries that your server sends, as UDP is a stateless protocol. Don't block it if you want any kind of outbound connectivity, software updates, etc.

Note that for name resolution software in most modern operating systems that's been patched with DNS source port randomization, the source port of the queries (and thus, the destination port of the response) won't necessarily be 53; in those cases, it's probably safe (but unnecessary, unless you have a rogue DNS resolver listening) to block UDP port 53.

Would this command secure that port using iptables in Linux

You don't need to allow TCP 53 inbound unless your server is actually a DNS server. Your second command has -m udp -p tcp, which doesn't make a lot of sense.. typo?

Shane Madden♦Shane Madden

105k9 gold badges151 silver badges226 bronze badges

If only use your local network, use a local nameserver and have no connection to random sites on the Internet then you do not need to leave port 53 open. But if you do want to use the Internet then you need to be able to translate hostnames to IP addresses. For that you need DNS.

HennesHennes

4,5801 gold badge15 silver badges29 bronze badges

When would you open port 53? I would assume when you are hosting DNS zones. Are you running DNS internally or subbing it out? If you run than you better have 53 open if you want anyone to get the records. As you said you have your DNS hosted elsewhere there is no reason to keep these ports open even with Vhosts and whatnot.

As far as the IPtables rule I'm not sure what you mean by secure, but that will open the port for you.

JacobJacob

7,7284 gold badges39 silver badges55 bronze badges

DNS uses UDP port 53

Why would I need this?

If you want to use your server as a DNS server (for example you're hosting your own domains)

mangiamangia

If the application server in question is not a DNS server then you do not require port 53 to be open. An 'open port' means that the port is externally visible to clients in the network (or out on the internet, possibly). Contrary to popular belief a server or host does not need to have port 53 open to make outgoing DNS queries - this is not how the TCP/IP model works. You can run tcpdump on a host and then issue a DNS lookup from another terminal or browser to confirm this:

Dns Udp 53

So to answer your question: You would only open port 53 on a host that is offering DNS services to a network.

Not part of your question, but it would be advisable to have a firewall installed on any and all network server hosts. This safeguards against instrusion from attacks originating outside the network as well as against virus/trojan and 'very clever' (but malignant) users inside the network. A firewall would also simplify the task of opening and closing ports as well as setting access policies as you wish, thereby circumventing the need to manually create (and remember) complex iptables rules.

venzenvenzen

Not the answer you're looking for? Browse other questions tagged linuxdomain-name-systemsecurityfirewallport or ask your own question.

Active5 years, 4 months ago

Well, actually I know that the risk is that somebody from an external network could access IPs and hostnames of the machines on a local network, but I am struggling to understand if this is it or if there is something else.

If the devices on the local network are all behind NAT, what would an attacker do with just a simple list of local IPs and hostnames?

user1301428user1301428

1,5971 gold badge18 silver badges27 bronze badges

1 Answer

It's all about recon. The more an attacker can map your network, the better off they are. This can be especially sensitive if you have static IP's that don't move around.

DNS servers, given you do not separate out recursive services from SOA (given you have any), can be used for various attacks that will affect hosts on your network such as cache poisoning.

Not to mention, that by opening up your DNS server with little config tweaking (rate-limiting, ACLs, etc.), you are opening yourself up for DNS Amplification and Reflection attacks similar to what is being seen with NTP lately. Examples and explanations of the NTP reflection can be found here:https://isc.sans.edu/diary/NTP+reflection+attacks+continue/17654

If you would like to know how to best secure your DNS server, I point you to the following document that the NSA published on securing the DNS architecture. All NSA jokes aside, this is some very good information that falls inline with industry best practices. The document can be found here:http://www.nsa.gov/ia/_files/vtechrep/I733-004R-2010.pdf

Cisco Router Port 53

PTW-105PTW-105

5 Answers

Dns Udp 53

Not the answer you're looking for? Browse other questions tagged linuxdomain-name-systemsecurityfirewallport or ask your own question.

1 Answer

Cisco Router Port 53

Port 443

Not the answer you're looking for? Browse other questions tagged dnsport-forwarding or ask your own question.

Hack Router Port 53 Dns Lookup