Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco (877) router acting as the main gateway for a network; it has a DSL connection and performs NAT from the internal network to its external, public IP address.

The router allows SSH access for management, and this has been limited using an access list:

access-list 1 permit <internal network range>

line vty 0 4
    transport input ssh
    access-class 1 in

The router's internal web server isn't enabled, but if it was, I know its access could be limited using the same logic:

ip http access-class 1

Now, the gotcha: this router also acts as a DNS server, forwarding queries to external servers:

ip name-server <ISP DNS 1>
ip name-server <ISP DNS 2>
ip dns server

My problem is: the router is perfectly happy to answer DNS queries when receiving them on its external interface.

How can I block this kind of traffic so that the router only answers DNS queries from the internal network?

share|improve this question

3 Answers 3

Put an ACL on the external interface. Works just the same. Make an ACL, extended or regular, then apply it but on the external interface, allowing only the traffic you want. Regardless of DNS you should have that.

I haven't tried that myself (wouldn't run a DNS on my routers)... but this seems to be what you are looking for:

DNS View Usage Restrictions Based on the Query Source IP Address

A standard IP ACL is a numbered or named set of host IP address-matching rules, with each rule specifying the type of action to be performed if an IP address matches the text string pattern in the rule. The Split DNS feature supports the use of a standard ACL as a view-use restriction based on the query source IP address. In order for a source IP address to match a name list, the IP address must match a rule that explicitly permits a matching pattern but the IP address cannot match any rules that explicitly deny a matching pattern.

http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htspldns.html#wp1049435

share|improve this answer
    
Ok, so this is not to be handled at the service level (like SSH and HTTP) but at the interface level? –  Massimo Feb 26 at 21:05
    
I really don't see any other way. –  ETL Feb 26 at 21:14
    
I tried, but there's a problem: I can successfully block incoming UDP/53 packets on the external interface... but then DNS replies from Internet DNS servers are blocked too! –  Massimo Feb 26 at 21:31
    
Maybe post your ACL and how you applied it. –  ETL Feb 26 at 22:42
    
A deny for UDP/53 packets coming from anywhere, applied as an input ACL to the external interface. Unfortunately, UDP is connectionless, thus the router can't tell if a packet is a new DNS query coming from a complete stranger, or an answer to a query it started iself... –  Massimo Feb 26 at 22:59

I would add a comment but I cannot. The answer is to simply add an allow statement for your DNS servers that you use so if you're using Google's 8.8.8.8 then add a permit statement for udp port 53 from 8.8.8.8 above your deny statement.

OR use reflexive ACLs: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html

share|improve this answer
!Deny DNS from Public 
 ip access-list extended ACL-IN_FROM-WAN
  remark allow OpenDNS lookups
  permit udp 208.67.222.222 0.0.0.0 any eq domain
  permit tcp 208.67.220.220 0.0.0.0 any eq domain
  remark deny all others and log the attempts
  deny   udp any any eq domain log
  deny   tcp any any eq domain log
  permit ip any any

! Apply to WAN interface
 int WAN
  ip access-group ACLIN-TO_WAN in
share|improve this answer
2  
While in theory this answers the question it would be best if you explained what this is. –  Jacob Jun 19 at 6:49
1  
Please feel free to edit your post to make it readable and understandable. –  Deer Hunter Jun 19 at 8:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.