<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi,</span></div><div><span></span> </div><div><span> I am able to query one of the PTR record available in my company BIND caching DNS server from internet(ANY IP address) successfully. As per your statement, <span>If I am denying the response, how could I get response successfully?</span></span></div><div><span><span></span></span> </div><div><span><span>Regards</span></span></div><div><span><span>Babu</span></span></div><div><span></span> </div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <div class="hr" style="margin: 5px 0px; padding: 0px; border: 1px solid rgb(204, 204, 204); height: 0px; line-height: 0;
font-size: 0px;" contenteditable="false" readonly="true"></div> <b><span style="font-weight: bold;">From:</span></b> Mark Andrews <marka@isc.org><br> <b><span style="font-weight: bold;">To:</span></b> babu dheen <babudheen@yahoo.co.in> <br><b><span style="font-weight: bold;">Cc:</span></b> "bind-users@lists.isc.org" <bind-users@isc.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, 25 March 2013 12:33 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Suspecious DNS traffic<br> </font> </div> <br><br>In message <<a href="mailto:1364140396.42023.YahooMailNeo@web190806.mail.sg3.yahoo.com" ymailto="mailto:1364140396.42023.YahooMailNeo@web190806.mail.sg3.yahoo.com">1364140396.42023.YahooMailNeo@web190806.mail.sg3.yahoo.com</a>>, babu d<br>heen writes:<br>> <br>> Dear,<br>> <br>> We have Caching DNS server and certain PTR record(reverse entry <br>> verification purpose) only is
allowed from internet. But I am observing <br>> suspicious DNS traffic from my BIND caching DNS server towards <br>> 67.215.80.15,67.215.80.13,207.192.69.4,67.227.239.85 IP address on <br>> destination port 1033,1090,1743, etc. Since we haven't allowed non <br>> standard port from our DNS server to public DNS server, its dropped in <br>> firewall.<br>> <br>> Any idea as to why our company DNS server is contacting external IP on <br>> non standard port?<br><br>It's contacting it on port 53. You are allowing the query out but<br>denying the response.<br> <br>> Below is the logs taken from DNS server on one of the destination IP <br>> address.<br>> ##########################################################################<br>> ##<br>> <br>> <br>> client 67.215.80.15#58230: view localhost_resolver: query (cache) <br>> '109.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.215.80.15#18395:
view localhost_resolver: query (cache) <br>> '86.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.215.80.15#34068: view localhost_resolver: query (cache) <br>> '114.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.227.239.85#20915: view localhost_resolver: query (cache) <br>> '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.227.239.85#64724: view localhost_resolver: query (cache) <br>> '232.12.217.in-addr.arpa/NS/IN' denied<br>> client 67.227.239.85#16374: view localhost_resolver: query (cache) <br>> '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.227.239.85#30391: view localhost_resolver: query (cache) <br>> '232.12.217.in-addr.arpa/NS/IN' denied<br>> client 67.227.239.85#17745: view localhost_resolver: query (cache) <br>> '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.227.239.85#36163: view localhost_resolver: query (cache) <br>> '232.12.217.in-addr.arpa/NS/IN'
denied<br>> client 67.227.239.85#6391: view localhost_resolver: query (cache) <br>> '232.12.217.in-addr.arpa/NS/IN' denied<br>> client 67.227.239.85#37586: view localhost_resolver: query (cache) <br>> '150.232.12.217.in-addr.arpa/PTR/IN' denied<br>> client 67.227.239.85#55208: view localhost_resolver: query (cache) <br>> '232.12.217.in-addr.arpa/NS/IN' denied<br>> client 67.227.239.85#40076: view localhost_resolver: query (cache) <br>> '232.12.217.in-addr.arpa/NS/IN' denied<br>> <br>> Below is the firewall logs:<br>> #########################<br>> action=Deny sent=0 rcvd=112 src=our_company_DNS_server_ip <br>> dst=67.215.80.15 src_port=53 dst_port=16529<br>> action=Permit sent=0 rcvd=0 src=67.215.80.15 <br>> dst=our_company_DNS_server_ip src_port=52370 dst_port=53 <br>> <br>> <br>> Regards<br>> Babu<br>> <br><br>-- <br>Mark Andrews, ISC<br>1 Seymour St., Dundas Valley, NSW 2117,
Australia<br>PHONE: +61 2 9871 4742 INTERNET: <a href="mailto:marka@isc.org" ymailto="mailto:marka@isc.org">marka@isc.org</a><br><br><br> </div> </div> </div></body></html>