Cisco Router ACL Security Issue

[Bob Smith]

I received a cisco router for my cablevision service. I recently discovered that the router is somehow acting like a DNS server on the WAN. I tried to create an access list to deny this but have been unsuccessfu:

FE0 is my PC (which is on vlan1), and my cable modem is on GE0.

Two questions regarding this issue, 1. Why does the ACL still permit DNS traffic to come to my router from the internet (and ask my router for a DNS question), and 2. Since I found this issue by fluke, how would I know if there are other potentially harmful services like this running on my router, that I may stumble upon in the future?

I worry that I may have misconfigured the router thus opening it up for a potential security related issues. I just happened to find this issue out of chance.

Also, are there any other ACLs that should be added? I figured that because I've configured a overloaded NAT, it was secure.

Thanks in advance.

[Thotsaphon Lueangwattanaphong]

Hi,

   You don't want people out there to use your router as a proxy DNS. Right? Please try this for testing.

!

access-list 100 deny udp any any eq 53

access-list 100 deny tcp any any eq 53

access-list 100 permit ip any any

!

HTH,

Toshi

[Bob Smith]

If I apply that rule to "in" on GigabitEthernet0 (WAN), it doesn't work, and IOS still acts as a proxy dns to people on the internet. If I apply that rule to "out" on GigabitEthernet0, I am unable to get DNS requests out, which is expected.

I don't know why it doesn't work for the "in" group as it should. This sounds like a bug in the IOS software.

[Thotsaphon Lueangwattanaphong]

Hi,

     You should not apply it on outbound direction. It's going to block your DNS request to 8.8.8.8 and 8.8.4.4. Have you blocked both tcp/53 and udp/53 on inbound direction?

!

access-list 100 deny udp any any eq 53 log

access-list 100 deny tcp any any eq 53 log

access-list 100 permit ip any any

!

interface gig0

ip access-group 100 in

!

   Please clarify what you mean it doesn't work. You are going to deny DNS request from outside. We just add the log keyword for testing.

HTH,

Toshi