topic DNS Server Behind Pix in Network Security

DNS Server Behind Pix

david.morrow — Fri, 21 Feb 2020 08:09:25 GMT

Hi all. I am attempting to do something which I would assume is quite simple. I have a Pix 515 running version 6.3

I want to place a publicly accessible DNS server behind the Pix. I created a static NAT entry for the DNS server (which is on a private IP) and access rules to allow TCP and UDP port 53 in to it. It doesn't work.

I have confirmed that an access rule to port 80 on the server works.'

Is there something special I must do to make this work?

Re: DNS Server Behind Pix

Frank Durham — Fri, 20 May 2005 16:47:32 GMT

David-

Here is what I have on my Pix and it works just great. I am using Pix 520 v6.34.

access-list 100 permit tcp any host xxx.xxx.xxx.xxx eq 53

access-list 100 permit udp any host xxx.xxx.xxx.xxx eq 53

static (inside,outside) xxx.xxx.xxx.xxx (dns_ip_address) 255.255.255.255

fixup protocol dns maximum-length 512

That should allow you to have your DNS server available to the outside for queries and transfers.

Frank