LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-03-2002, 05:09 PM   #1
vertices
LQ Newbie
 
Registered: Apr 2002
Posts: 5

Rep: Reputation: 0
DNS problems through firewall


Ok heres the deal:

I have 4 PCs right now in the current configuration.

Computer A is configured as a router/firewall with 3 nics as such: DHCP,192.168.1.1,10.0.0.1 This computer is running smoothwall (www.smoothwall.org a stripped down nice and easy secure linux router/firewall) and has the DMZ on the 10.0.0.1 network and the internal network is on the 192.168.1.1

Computer B is a Win2K Adv. Server acting as a primary domain controller with DHCP (only DHCP to the 192.168.1.0 addresses, the DMZ is all hardcoded) and serving web and ftp to external visitors.

Computers C and D are WinXP pro workstations on the 192.168.1.0 network.


I have setup dhcrelay on Computer A so it routes any DHCP requests from the 192 network to the server at 10.0.0.2. This works fine and the 192 network can receive their addresses. However they can not login to the domain because they cant get DNS requests DNS server. They cant surf the web either because of the DNS.

All ports are blocked from the DMZ to the internal network from the firewall. I can pinhole from the DMZ to the internal network and the pinholes do funtion as I have tested this extensively. I have basic TCP/IP connection because I can logon to it via IP. I can print to a printer that it is sharing.

I pinholed port 53 TCP and UDP to my internal network as well as any other port that showed up as being blocked in my logs during trouble shooting. I still cant receive DNS requests.

I know the server is functioning properly because I reconfigured it with a 192.168.1.201 IP and adjusted the DHCP scope to reflect this and moved it to the switch for the 192 network thus eliminating computer A and of course everything works perfectly. As soon as I put everyting back and move it back to the 10 switch and reconfigure it I cantcontact DNS. So I know for a fact the problem lies with getting the requests through the firewall.

I have swapped NICs across the board and swapped switches as well. I can't seem to make this work. I know this si long but I wanted to let you know exactly what was happening and what I've already tried.

Thanx for your time.
 
Old 04-03-2002, 05:42 PM   #2
DavidPhillips
LQ Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,163

Rep: Reputation: 58
I got confused between 10.0.0.1 and 10.0.0.2

I am counting 5 computers


Assuming A is 10.0.0.2 or there is a second interface on C or D


Anyway Are you using iptables and what are your rules for port 53, and how are they arranged in the file?

also have you tried setting up A as a DNS for the internal lan, so you don't have a hole into the 192 network.


I guess /etc/resolv.conf is correct.




Last edited by DavidPhillips; 04-03-2002 at 05:47 PM.
 
Old 04-03-2002, 05:56 PM   #3
vertices
LQ Newbie
 
Registered: Apr 2002
Posts: 5

Original Poster
Rep: Reputation: 0
4 computers

computer A has 3 nics. 1 on DHCP to cable modem. 2 on 10.0.0.1 and 3 on 192.168.1.1 Nic 1 goes to modem. Nic 2 to a swtich and Nic 3 to a switch.

Nic 2 with the 10.0.0.1 is the DMZ network and it connects to the switch which has Computer B (10.0.0.2) on it

Nic3 with the 192.168.1.1 goes to a switch with the the 2 workstations (Computers C and D) on it.

I think it may be ipchains. I have not checked. Smoothwall has a nifty web interface that handels everything. It has a section for DMZ pinholeing and it does work. I tested it with FTP.

DNS must go to the Win2K server to update the DNS records for active directory. I cant just use the DNS proxy on smoothwall.

Thanx for the help
 
Old 04-03-2002, 07:40 PM   #4
vertices
LQ Newbie
 
Registered: Apr 2002
Posts: 5

Original Poster
Rep: Reputation: 0
Actually I think I solved my own problem.

The way I see it is that a client on the 192.168.1.1 network is sending a request to the DNS servers port 53. This part gets through. The server then sends back to any random port above 1024 which is gettin blocked by the firewall.

The only answer would be to open up all ports above 1024 from the server in the DMZ to the internal network which sort of defeats the purpose of the DMZ.

Sound correct? Anybody?
 
Old 04-03-2002, 08:53 PM   #5
DavidPhillips
LQ Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,163

Rep: Reputation: 58
Yep the "unpriviledged" ports 1024:65535

are used

You should be able to fix this by setting up a dns server and set it to port 53 and query-source port *

then use this

echo "56000 65096" >/proc/sys/net/ipv4/ip_local_port_range

ipchains -A input -p udp -s 0/0 domain -d 0/0 56000:65096 -j ACCEPT

ipchains -A input -p tcp -s 0/0 domain -d 0/0 56000:65096 -j ACCEPT



Last edited by DavidPhillips; 04-03-2002 at 09:00 PM.
 
Old 04-04-2002, 12:28 PM   #6
vertices
LQ Newbie
 
Registered: Apr 2002
Posts: 5

Original Poster
Rep: Reputation: 0
Thanx for the help David! I will try that when I get home from work.

Although doesn't this put a big hole between the DMZ and my inernal network?

My other idea was to put another pc running a full distro in the DMZ and use that for web/mail/ftp since my internal network has no problem accessing those services from the DMZ. I could then have everything I need without punching a huge gaping hole in the firewall, only a few small ones.

What do you think?
 
Old 04-04-2002, 01:13 PM   #7
DavidPhillips
LQ Guru
 
Registered: Jun 2001
Location: South Alabama
Distribution: Fedora / RedHat / SuSE
Posts: 7,163

Rep: Reputation: 58
right,

I would put the dns server in the DMZ
Also you could only allow the ports to be connected to by the servers of your choice.
 
Old 04-04-2002, 02:07 PM   #8
vertices
LQ Newbie
 
Registered: Apr 2002
Posts: 5

Original Poster
Rep: Reputation: 0
Thanx again David!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Sudden DNS problems on firewall PC l0n3w012ph Linux - Networking 3 08-17-2005 04:42 AM
MandrakeSecurity Single Network Firewall Product DNS Problems jonpritcharrd Linux - Newbie 1 07-29-2002 06:18 AM
MandrakeSecurity Single Network Firewall Product DNS Problems jonpritcharrd Linux - General 1 07-10-2002 10:43 AM
MandrakeSecurity Single Network Firewall Product DNS Problems jonpritcharrd Linux - Networking 0 07-09-2002 02:59 PM
DNS problems with Bootable Firewall CD SpookMonkey Linux - Networking 1 05-08-2002 09:23 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:13 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration