How to check if port forwarding is enabled?

Question

I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled.

The thing that is not clear to me is this: should I configure this at the router level or at the firewall level? If I should do this on the firewall, how would I go about doing this on an Ubuntu Server 12.04?

My home network has a few clients, an ESXi server and a home router. One of the VMs inside ESXi is the DNS server (running on Ubuntu Server 12.04) which is used to handle local DNS requests but is also configured as to forward requests for external IPs to Google's DNS servers.

Answer 1

This should be configured on whatever equipment you have between the DNS server and the outside world. AFAIK port forwarding is disabled by default on pretty much everything so you shouldn't worry too much about it. If you're using residential network gear, there should be port forwarding configuration options in the web interface. To check the port forwarding settings on Ubuntu use iptables:

$ sudo iptables -t nat -vnL

To ultimately check your network for the forwarded port use netcat to connect to the port via your external IP:

$ nc -vu [external ip] 53

You'll have to monitor the connections on the DNS server to watch for the netcat connection because netcat may incorrectly report that the connection was successful due to the stateless nature of UDP

Answer 2

I understand this question as check if the port is being forwarded I'd use something like this

test_port() {
    if [ $# -eq 0 ]; then
        echo "Usage: test_port <port_number>"
        return 1
    fi

    local port=$1
    local timeout=1
    local use_sudo=""

    # Check if we need sudo for ports below 1024
    if [ $port -lt 1024 ]; then
        use_sudo="sudo"
    fi

    # Try to start a listener on the specified port
    $use_sudo bash -c "echo 'Port tester running on $port' | nc -l -p $port" &
    local pid=$!

    # Wait a moment for the listener to start
    sleep 0.5

    # Test the port
    if nc -z $YOUR_IP $port -w $timeout 2>/dev/null; then
        echo "Port $port is open"
        result=0
    else
        echo "Port $port is closed or in use"
        result=1
    fi

    # Kill the listener process
    $use_sudo kill $pid 2>/dev/null

    return $result
}

set $YOUR_IP with your exposed IP. This will:

• Create a listener
• send a request to see if TCP is active
• kill the listener

It has some rough edges however, but just read the code, and you will get it.

Call it as test_port 8888 (to test if port 8888 is being forwarded)