2

Back story: I've got a domain controller exposed to the internet (I know, it shouldn't be, was put together piecemeal). Unfortunately, we just discovered that it's being used in LDAP reflection attacks. We're only using this for active directory, not much DNS work going on.

I can't make many changes to the physical infra at this stage and just want to limit requests hitting port 389 via UDP/TCP to LAN IPs only. I'm trying to limit issues and downtime as it's a high traffic environment.

I did notice in Resource Monitor > Network > TCP Connections, the public IPs for the other servers in the domain showing on port 389. I was under the impression communication to the AD was via the 10.1.1.x.

Questions:

Can I add only the LAN IP range 10.1.1.0/24 to the firewall rule for port 389 without breaking other AD/DC functionality?

Why would I see connections to the AD from other servers with their public IP?

Improve this question
  • Are all your servers connecting to the public DC multihomed with internal and public IPs? AD (almost) always uses its interal DNS zone to connect the servers/ services. I think all you can do is restrict your servers to register the public IP in DNS, so AD will only connect to LAN. If you just block the connections no matter what, you may break AD. (Manually) Clean up DNS, check your service connections etc. for public IPs, block public IPs. Could work. – Lenniey Oct 21 '19 at 10:28
  • All multihomed with public and internal IPs. The DNS looks OK with all servers showing up properly with correct internal IPs. If I block connections to 389, it will break it as I monitor the connections while logging in on another server, also LDAP uses the first connection to dish out ephermal ports (I think). I guess if it breaks and I immediately roll back, could there be delays/caching of those settings? Thanks. – Papa Oct 21 '19 at 10:35
0

So it's OK to only allow internal IPs in firewall for LDAP TCP/UDP (port 389) and Secure LDAP (port 636) by adding the internal IP range.

enter image description here

My AD is using 10.1.1.0/24

After changing the firewall, my network activity went from 50-90Mbps to 1Mpbs over time.

Note: In some cases, it can take a while for the outgoing connections to remove themselves. I'm guessing this is down to the issue of ephermals ports and a certain time period or continued activity.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.