topic Re: return traffic acl issues in Network Security

return traffic acl issues

ryancolson — Mon, 11 Mar 2019 10:38:11 GMT

I have a 1721 router at home as my gateway to the internet and firewall, running fw ios 12.3.22. i have 5 static ips and currently using 2 internal networks each one on a different public ip. i have overloaded nat set up and the actual ip on the internet facing interface is in the middle of my range and at the moment not in use. the problem im having is return udp traffic. I do not want to permit everything inbound on the wan side so i set up an access list to allow the inbound traffic i needed and return udp traffic. The problem so far has been DNS. When i looked at the logged blocks it looks like the return dns traffic is going to a different port then 53. I am guessing this is due to the natting but i do not know what the best way to get around this is. i have the permit any any eq 53 but because the retrun traffic seems to be coming in on a different port.

Re: return traffic acl issues

palomoj — Mon, 02 Jul 2007 02:45:28 GMT

Do you have DNS inspection enabled?

If you want to permit return DNS replies through your WAN ACL you need to have an ACL entry like the following:

permit udp any eq domain any

permit udp host x.x.x.x eq domain any

Re: return traffic acl issues

ryancolson — Mon, 02 Jul 2007 02:55:27 GMT

i have a line in there

access-list 101 permit udp any any eq 53

I had the denied traffic loged and the dest. port on the return dns querys wasnt port 53

Re: return traffic acl issues

palomoj — Mon, 02 Jul 2007 04:28:22 GMT

that ACL line does not apply to return UDP DNS replies, it will allow inbound UDP DNS resolution requests

Re: return traffic acl issues

ryancolson — Mon, 02 Jul 2007 12:11:23 GMT

so the acl for any return udp traffic would be

permit udp any eq any?

Re: return traffic acl issues

acomiskey — Mon, 02 Jul 2007 12:26:36 GMT

Yes, palomoj has this right. The return traffic would have a source port of 53 and a destination port of any.

Re: return traffic acl issues

ryancolson — Mon, 02 Jul 2007 12:29:21 GMT

Thank you very much. I am still kinda new at this and i really appreciate you guys helping me out. Also just out of curiosity is their any way to make all blocked ports not respond instead of responding as closed or blocked(to stealth them)

Re: return traffic acl issues

srue — Mon, 02 Jul 2007 16:53:46 GMT

It's probably better to use reflexive acl's in this case..

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_reference_chapter09186a00800ca7bb.html