Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
Hi, everyone
I have Slackware 10.2 with KDE 3.5 installed
on my PC. The problem is that, when in KDE,
it floods the DNS server (equals gateway)
with packets on UDP port 53. The server
responses but my transfer rate is very low
now and I'm sure the server isn't liking
this either.
When in text mode there is no problem at
all.
I installed the default KDE 3.4 that came
with the distro but the problem persists. I
reinstalled X, the problem persists. I
recompiled the kernel (2.6) and the problem
still persists.
Any idea what is wrong?
Alex.
Am I asking for too much if I want you to block the port with iptables?
Santanu Sen
National Institute of Technology
Durgapur
India
0 
Yes, of course.
It's FreeBSD so there is bpf, ipfw or ipf.
No ipchains/iptables.
If I block that port how will I be able to
surf the net? We don't work with IP's but
with domain names these days. So who will
translate me the domain names into IP's if
not the DNS system?
Do a "grep 53 /etc/services" and search for
ports 53 on both tcp and udp.
0
Use ethereal or tcpdump to examine the traffic to see if you can find out what is making the requests.
0
You could set up a caching-only name server. By default, the queries would be performed through a random port, and any previous queries would reference the cache, rather than rely on the remote DNS.
I use it all the time.
0
#################
# Caching-only NS
# FreeBSD
#################[1]
# /etc/resolv.conf
nameserver 127.0.0.1
[2]
# named.conf
# Uncomment forwarders line
# (remove "/*" & "*/")/*
forwarders {
dns_address_1;
dns_address_2;
};*/
[3]
# Start named at boot
# /etc/rc.conf
named_enable="YES"
[4]
#/etc/namedb/localhost.rev
# Run make-localhost
cd /etc/namedb
sh make-localhost[5]
# Manual options
# --------------
# Start named
# Stop named
# Status/etc/rc.d/named start
/etc/rc.d/named stop
/etc/rc.d/named status
0
Well, I'm a little confused as to whether your problem is in Slackware or FreeBSD.
If you're running FreeBSD, I know of no such exploit. Another workaround did occur to me: you could tie yor address resolution to a group.
Say, for instance, you create a group called "resolve", and add yourself to it and root (for ports):
# pw groupadd resolve -M root,you
Then, just add something like this to IPFW rule set, replacing the example DNS addresses with your actual addresses:
DNS1="1.2.3.4"
DNS2="5.6.7.8"add pass udp from any 53 to { DNS1 or DNS2 } 53 out gid resolve keep-state
That would have the effect of blocking anything outward-bound from port 53, except that of address queries by you and root.
If you're running a caching-only NS, set-up "bind" as a member of the group, and your firewall line w/o the port 53 specification:
# pw groupadd resolve -M bind
add pass udp from any to { DNS1 or DNS2 } 53 out gid resolve keep-state
That will block everyone but bind from querying the remote DNS server.
For the record, I'm running FreeBSD 6.0 w/KDE 3.4.
0
Correction:
add pass udp from any 53 to { $DNS1 or $DNS2 } 53 out gid resolve keep-state
add pass udp from any to { $DNS1 or $DNS2 } 53 out gid resolve keep-state
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
