Re: Paranoid question regarding Bind

[Rémi Guyomarch <rguyom@pobox.com>]

On Wed, Oct 31, 2001 at 07:55:27PM -0800, Jacob Meuser wrote:
> On Wed, Oct 31, 2001 at 06:15:54PM -0800, Steve Wingate wrote:
> > I use the built-in BIND on my 2.9 to provide internal DNS, and I have it configured to use my ISP's DNS servers as forwarders. As such, I ONLY need to allow my ISP's DNS servers to contact mine. I use ipf rules like so:
> > 
> > #allow udp dns replies from @home servers
> > pass in quick on fxp0 proto tcp/udp from 24.5.156.15 to a.b.c.d
> > pass in quick on fxp0 proto tcp/udp from 24.5.156.17 to a.b.c.d
> > 
> > a.b.c.d is my public IP address. This prevents anyone else from using my DNS server, I hope. 
> > 
> >
> Shouldn't you also have some kind of 'port' setting there also?
> 
> Can't pf also do stateful udp?  Yes, from pf.conf(5)
> 
>   # pass out all UDP connections and keep state
>   pass out on $ext_if proto udp all keep state

Sure, but remember that UDP is state-less by nature. PF can't know if
an UDP packet sent by A to B two seconds after B sent one to A is a
reply to the first one or something completely different.
Still, it's better than nothing.

-- 
Rémi