<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Hi Matus,<br><br>Still not convinced because if i need to allow >1024 port from our DNS server to external world(internet).. where is the security?<br><br>I beleive we just need to allow TCP and UDP 53 from our DNS server to internet(any) which is already done. Not sure why we have to open non standard port from our DNS server to internet?<br><br>Kindly provide some details.<br><br>Regards<br>Babu<br><div><span><br></span></div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Matus UHLAR - fantomas <uhlar@fantomas.sk><br> <b><span style="font-weight:
bold;">To:</span></b> bind-users@lists.isc.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, 25 March 2013 3:30 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Suspecious DNS traffic<br> </font> </div> <br>On 25.03.13 16:59, babu dheen wrote:<br>> I am able to query one of the PTR record available in my company BIND<br>> caching DNS server from internet(ANY IP address) successfully. As per<br>> your statement, If I am denying the response, how could I get response<br>> successfully?<br><br>you must allow the packets from TCP+UDP port 53 coming to any >=1024 port on<br>your nameserver.<br><br>-- Matus UHLAR - fantomas, <a ymailto="mailto:uhlar@fantomas.sk" href="mailto:uhlar@fantomas.sk">uhlar@fantomas.sk</a> ; <a href="http://www.fantomas.sk/" target="_blank">http://www.fantomas.sk/</a><br>Warning: I wish NOT to receive e-mail advertising to this address.<br>Varovanie: na tuto adresu
chcem NEDOSTAVAT akukolvek reklamnu postu.<br>The only substitute for good manners is fast reflexes. _______________________________________________<br>Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br><br>bind-users mailing list<br><a ymailto="mailto:bind-users@lists.isc.org" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br><br><br> </div> </div> </div></body></html>