Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 2 subscribers
  • Views 3567 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

dns traffice default drop

utm_kid
Hello , 

this is strange to me that ,*some of * dns trafice is default drop 
and that is from public ip to public ip 

i have  tcp/udp dns allow to any >any>any 

why ?
https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34761 i am trying to dns server /internal dns server

edit: i also notice this while dns delegation 
thanks


This thread was automatically locked due to age.
  • 0
    Hi,

    1. please don't create 2 threads for the same subject.

    2. one should provide log entries when talking about dropped traffic

    Barry
  • 0 in reply to BarryG
    No ,sir 

    i was under impression that this could be different issue ,sorry 

    23:05:03  Default DROP  DNS   77.23.x.x : 37765 → 1.x.2x1.1x6 :53 len=74 ttl=49 tos=0x00

    but this are just some packers ,check with tcpdump many packet are going trough 

    what should be dns's global tab ? (blank or with networks) if i am using internal dns server 
    ,if it is blank how wifi and vpn network will work ? (when its even blank i am able to send text whatsapp message but was not able to browse internet using browser ) that is very strange too me 
    if you think we can discuss this issue on same (original thread please merge threads)



    Thanks
  • 0 in reply to utm_kid
    Hello ,

    still i am faceing this problem 
     

    2015:04:16-00:23:27 utm ulogd[4556]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth1" mark="0x7c" app="124" srcmac="00:90:0b:23:28:a2" dstmac="00:15:17:7a:e3:60" srcip="77.23.x.x" dstip="1.2x.x1.1x6" proto="17" length="74" tos="0x00" prec="0x00" ttl="49" srcport="39855" dstport="53" 
    2015:04:16-00:23:32 utm ulogd[4556]: id="2014" severity="info" sys="SecureNet" sub="packetfilter" name="DNS request" action="DNS request" fwrule="60011" initf="eth1" srcmac="00:90:0b:23:28:a2" dstmac="00:15:17:7a:e3:60" srcip="77.23.5x.x1" dstip="1.2x.2x1.1x6" proto="17" length="74" tos="0x00" prec="0x00" ttl="49" srcport="44667" dstport="53" 

    Thnks
  • 0 in reply to utm_kid
    when i try to delegation the my name server (using bind9) on ubuntu there is default drop from DNS system to my  punlic ip ,
    https://blogs.sophos.com/2015/02/26/utm-up2date-9-308-released/

    34041 CVE-2014-8500: A Defect in Delegation Handling Can Be Exploited to Crash BIND

    do i to make some more configure change ,using latest version 9.310-11

    thanks
  • 0 in reply to utm_kid
    is it BUG ?

    as i see couple of  reverse-dns.plx.8833 dump

    thanks
Unfiltered HTML