• This question relates specifically to hardening the configuration of DNS, firewalls and at the limit, ntp. (not proxys, http access,vpn's or other services).
  • This is about the externally-facing side of the network. DNS clients are locally connected inside on a separate interface card of the dns server. I just want to remove my DNS server's clients or other internal stuff from the equation.
  • Trying to open the least amount of ports and restrict the open ports as much as possible anywhere in the stack (by tcp/udp, source/dest port....).
  • My biggest concern is that from my understanding, my DNS server queries to other DNS servers can be made with a source port between 1024 and 49152, but I do not want to open all those ports.
  • The firewall is using "masquerade" (NAT).
  • DNS is using dns-sec.
  • Security is the priority over a slower response time.
  • If you can provide an answer with the least amount of ports/protocols etc ... (including "obvious" ports), aka smallest attack surface that must be open for the DNS to communicate to other servers and why that is, that would be most helpful.
  • As FirewallD is a newer front end in the *nix world, any example that might use FirewallD (rather than straight iptables or pf) would be of additional value.

  • This is essentially a general question, but terms of my context, I have common standard applications: an RHEL-family linux server with bind DNS, Squid Proxy, and firewallD firewall, all in the same machine, facing the external internet.

    I have looked around and see a number of specific questions that are dependent on specific software or fixing a problem. This question relates more to approach and security than specific applications. Thanks in advance for your time.

  • As per the sites question policy, I tried to be clear with my question. The least amount of open ports, and those open, the most restricted for a general dns server setup. This is a great opportunity for an answer that is useful for many people. I can adapt a general answer to my specific gear. I had to choose between posting here or in Network Infrastructure, but this forum seemed more appropriate.
    – BloodyEl
    Jun 3, 2016 at 7:41
  • The traditional solution is having a Internet DNS server and a separate internal one. Jul 17, 2016 at 18:37

1 Answer 1


Using Bind it's possible to limit the set of source ports used for a query. DNSSec aside, restricting the source port too much makes it easier for fake replies to be injected.

If you want to lock down entirely, you could use an external proxy such as Google's DNS servers on Single (internal) source. Single destination for all queries. I can't advise on the DNSSec aspect for this, though.

The reference NTP implementation uses port 123 for source and destination, but not every implementation does so. Unless you control the upstream server you're not yet going to get a security pairing, so you need to be able to reach servers that are "sufficiently" trusted. Ideally three or five. Certainly not just two ("they're different, but which one's wrong"). It's very easy to find Stratum 3 servers. Not too hard to find Stratum 2s, and if you look it's possible to find public access Stratum 1s. (Or you could just run your own GPS based receiver. They're not excessively expensive these days.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .