Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 2 subscribers
  • Views 1318 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS listening where it shouldn't?

Jack Daniel
Hi folks, been a while...

I'm probably missing something obvious, but my UTM9 (9.002) has DNS open on the WAN interface, and it is not configured to do so.  No NAT rules are active which should come into play.

netstat shows named is listening on interfaces where I don't want or expect it to listen (interfaces not listed in DNS Allowed Networks), including the WAN interface- and it is responding to external DNS queries. Listening on both TCP and UDP, too. 

Any thoughts?

Thanks
Jack


This thread was automatically locked due to age.
Parents
  • 0
    I'm just ran NMAP remotely against my 3 Astaro firewalls; 7.509, 8.305, and 9.001; all show 

    PORT   STATE    SERVICE
    53/tcp filtered domain

    and 
    PORT   STATE         SERVICE
    53/udp open|filtered domain


    I used
    nmap -sU -Pn -p U:53 target
    and
    nmap -Pn -p 53 target

    my netstat output looks similar.

    nslookup fails to work... Jack, is that what you're using to run remote queries?


    Barry
Reply
  • 0
    I'm just ran NMAP remotely against my 3 Astaro firewalls; 7.509, 8.305, and 9.001; all show 

    PORT   STATE    SERVICE
    53/tcp filtered domain

    and 
    PORT   STATE         SERVICE
    53/udp open|filtered domain


    I used
    nmap -sU -Pn -p U:53 target
    and
    nmap -Pn -p 53 target

    my netstat output looks similar.

    nslookup fails to work... Jack, is that what you're using to run remote queries?


    Barry
Children
No Data