I've setup Cisco router's DNS server... via "ip dns server" which in need for inside use.. however now if I do portscan from outside it shows port 53 opened. How do I block all traffic to that 53 port from outside since i need this DNS only inside my NAT/Overload network.
But if you plan to give internet-users access to an internal FTP-server in the future, then you also need the FTP-inspection in the inbound direction. But for that you could use the same rule as for your outbound traffic.
No it would only be enough for the FTP-control-channel. But if the client wants to do passive FTP, the server tells the client on which dynamic port these data is available. And because this session is initiated from the outside to the inside, the FTP-inspection has to be also done in the same direction.
