07-01-2007 04:09 PM - edited 03-11-2019 03:38 AM
I have a 1721 router at home as my gateway to the internet and firewall, running fw ios 12.3.22. i have 5 static ips and currently using 2 internal networks each one on a different public ip. i have overloaded nat set up and the actual ip on the internet facing interface is in the middle of my range and at the moment not in use. the problem im having is return udp traffic. I do not want to permit everything inbound on the wan side so i set up an access list to allow the inbound traffic i needed and return udp traffic. The problem so far has been DNS. When i looked at the logged blocks it looks like the return dns traffic is going to a different port then 53. I am guessing this is due to the natting but i do not know what the best way to get around this is. i have the permit any any eq 53 but because the retrun traffic seems to be coming in on a different port.
07-01-2007 07:45 PM
Do you have DNS inspection enabled?
If you want to permit return DNS replies through your WAN ACL you need to have an ACL entry like the following:
permit udp any eq domain any
or
permit udp host x.x.x.x eq domain any
07-01-2007 07:55 PM
i have a line in there
access-list 101 permit udp any any eq 53
I had the denied traffic loged and the dest. port on the return dns querys wasnt port 53
07-01-2007 09:28 PM
that ACL line does not apply to return UDP DNS replies, it will allow inbound UDP DNS resolution requests
07-02-2007 05:11 AM
so the acl for any return udp traffic would be
permit udp any eq
07-02-2007 05:26 AM
Yes, palomoj has this right. The return traffic would have a source port of 53 and a destination port of any.
07-02-2007 05:29 AM
Thank you very much. I am still kinda new at this and i really appreciate you guys helping me out. Also just out of curiosity is their any way to make all blocked ports not respond instead of responding as closed or blocked(to stealth them)
07-02-2007 09:53 AM
It's probably better to use reflexive acl's in this case..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide