DNS filtering

[brymiller]

Often you will see DNS filtered as UDP on port 53 (domain), yet DNS can also be TCP (also port 53, keyword domain). Is anyone aware of DNS implementations that use TCP? If asked to filter DNS would you create two ACEs, one UDP, one TCP?

[Richard Burts]

In general the TCP usage of DNS is for zone transfers. In general I would do a filter for UDP and be satisfied. Of course the best answer is to ask for clarification of exactly what they want and how restrictive they want to be.

HTH

Rick

[brymiller]

Found this gem in the PIX doc...

http://tinyurl.com/a94fc

You should have two access-list command statement definitions to permit access to the following ports:

•DNS, Discard, Echo, Ident, NTP, RPC, SUNRPC, and Talk each require one definition for TCP and one for UDP.

•PPTP requires one definition for port 1723 on TCP and another for port 0 and GRE.

•TACACS+ requires one definition for port 65 on TCP and another for port 49 on UDP.