How to block external access to the DNS service running on a Cisco router?

Question

I have a Cisco (877) router acting as the main gateway for a network; it has a DSL connection and performs NAT from the internal network to its external, public IP address.

The router allows SSH access for management, and this has been limited using an access list:

access-list 1 permit <internal network range>

line vty 0 4
    transport input ssh
    access-class 1 in

The router's internal web server isn't enabled, but if it was, I know its access could be limited using the same logic:

ip http access-class 1

Now, the gotcha: this router also acts as a DNS server, forwarding queries to external servers:

ip name-server <ISP DNS 1>
ip name-server <ISP DNS 2>
ip dns server

My problem is: the router is perfectly happy to answer DNS queries when receiving them on its external interface.

How can I block this kind of traffic so that the router only answers DNS queries from the internal network?

Answer 1

!Deny DNS from Public 
 ip access-list extended ACL-IN_FROM-WAN
  remark allow OpenDNS lookups
  permit udp 208.67.222.222 0.0.0.0 any eq domain
  permit tcp 208.67.220.220 0.0.0.0 any eq domain
  remark deny all others and log the attempts
  deny   udp any any eq domain log
  deny   tcp any any eq domain log
  permit ip any any

! Apply to WAN interface
 int WAN
  ip access-group ACLIN-TO_WAN in

Answer 2

Put an ACL on the external interface. Works just the same. Make an ACL, extended or regular, then apply it but on the external interface, allowing only the traffic you want. Regardless of DNS you should have that.

I haven't tried that myself (wouldn't run a DNS on my routers)... but this seems to be what you are looking for:

DNS View Usage Restrictions Based on the Query Source IP Address

A standard IP ACL is a numbered or named set of host IP address-matching rules, with each rule specifying the type of action to be performed if an IP address matches the text string pattern in the rule. The Split DNS feature supports the use of a standard ACL as a view-use restriction based on the query source IP address. In order for a source IP address to match a name list, the IP address must match a rule that explicitly permits a matching pattern but the IP address cannot match any rules that explicitly deny a matching pattern.

http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htspldns.html#wp1049435

Answer 3

I would add a comment but I cannot. The answer is to simply add an allow statement for your DNS servers that you use so if you're using Google's 8.8.8.8 then add a permit statement for udp port 53 from 8.8.8.8 above your deny statement.

OR use reflexive ACLs: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html

Answer 4

There's a simpler way to do it with NAT:

ip nat inside source static udp 1.1.1.1 53 interface GigabitEthernet0/0 53 

(With an 877 I guess your external interface would be Dialer0 or atm0.1 depending on if you use ppp, instead of Gi0/0 - whatever has "ip nat outside" on it)

This should divert all incoming connections, but all connections going out from the inside should have a matching entry in the NAT table and work. This also necessitates that you specify your internal interface as the source lookup interface:

ip domain lookup source-interface Vlan1

(substitute your own internal interface for Vlan1 if you're using something else)

And that should do the trick.

Answer 5

Suppose you have fa0 as WAN

ip access-list extended WAN_ACL_IN
  remark --- These are outgoing DNS queries.
  permit udp any eq domain any gt 1023

  remark --- Permit legitimate business traffic.
  permit tcp any any established
  permit udp any range 1 1023 any gt 1023

  remark --- Deny all other DNS traffic.
  deny   udp any any eq domain
  deny   tcp any any eq domain

  remark --- Explicitly deny all other traffic. 
  deny   ip any any

and you need to apply the acl to your WAN interface

 interface fa0 
   ip access-group WAN_ACL_IN in

Answer 6

If one had an outside interface G0/1 with IP 34.34.34.34. This ACL will block requests specifically coming from outside trying to hit your outside interface, while leaving other forms of DNS traffic unaffected.

 ip access-list extended Outside-In
    deny   udp any host 34.34.34.34 eq domain
    deny   tcp any host 34.34.34.34 eq domain
    permit ip any any
interface GigabitEthernet0/1
 ip access-group Outside-In in

Answer 7

I solved this problem on my network by giving my clients dns servers in the dhcp pool options, i discovered my isp's DNS servers, then turning off the dns server on the router - no ip dns-server